feat(lab11): reproducible Nix flake and CI-verified OCI image

[markovav-official]

Goal

Add a Nix flake that builds a bit-identical QuickNotes binary and OCI image, with CI that proves two independent runners produce the same digest.

Changes

• Add flake.nix / flake.lock — buildGoModule for QuickNotes + dockerTools.buildImage for OCI output
• Add .github/workflows/nix-repro.yml — two parallel nix build .#docker jobs and a digest comparison gate
• Add submissions/lab11.md with reproducibility proofs (VM store hashes, OCI tarball digests, Lab 6 comparison)
• Add submissions/attachments/lab11/ — build logs and hash captures
• Demonstrate CI gate with intentional red run (SOURCE_DATE_EPOCH + --impure in job A only), then restored green

Testing

• University VM: two independent checkouts → identical store hash and OCI tarball sha256sum
• curl /health → {"notes":4,"status":"ok"}
• Lab 6 Dockerfile: two --no-cache builds → different image IDs (non-reproducible baseline)
• CI green: run #1, run #4
• CI red (digest mismatch caught): run #3

Checklist

• Title is a clear sentence (≤ 70 chars)
• Commits are signed (git log --show-signature)
• submissions/lab11.md updated