Source global CLIs from nixpkgs instead of mise and uv

Source global CLIs from nixpkgs instead of mise and uv Moves 58 global tools into home.packages. Every attribute was checked against the nixpkgs index for aarch64-darwin before being listed, and the resulting closure dry-builds with no broken or unsupported packages. Naming worth recording, since the obvious guess is wrong in each case: kubernetes-helm is the `helm` binary (nixpkgs `helm` is unrelated), aws-cli is awscli2, protoc comes from protobuf, and dust is du-dust. Top-level `ansible` is ansible-core 2.21.3, not the 14.3.1 collection bundle. That is the deliberate trade for keeping ansible out of a python env: the `--with boto3 --with botocore` injection is gone with it, so amazon.aws modules will not work until that is revisited. java is absent because sdkman now owns JVM switching. maven stays in Nix: its wrapper sets JAVA_HOME with --set-default, so it defers to sdkman's export rather than overriding it. Also absent on purpose: claude, codex and pi-coding-agent self-update and a read-only store breaks their updaters; gcloud and cloud-sql-proxy were removed by request; android-sdk and googleworkspace/cli are unpackaged or wrongly packaged. All of those stay in mise's global [tools], now 7 entries instead of 57. Per-project mise.toml files are untouched, which matters for the three repos pinning versions unstable cannot serve. uv-tools.sh drops to 7 entries: three that are PyPI-only and four that exist only as python3Packages. Both ansible lines are removed so two ansibles do not land on PATH. This also fixes the pre-existing drift where basedpyright, hypothesis and semble were installed but undeclared. Tools that moved to Nix are not uninstalled from uv automatically; the script documents the one-time cleanup command. markitdown is worth watching: nixpkgs has 0.1.7 but whether the [all] extras are wired in is not visible in package metadata.