Handle Darwin-only package updates on Linux workers

[TyceHerrman]

Summary

Fixes #513.

Linux update workers can already update package sources for Darwin-only packages, but validation currently aborts when nix-build rejects the package metadata for the Linux host platform. This affects packages such as itsycal and tart.

This keeps normal validation strict first. If nix-build fails with Nix's not available on the requested hostPlatform metadata error, nixpkgs-update retries that build only with allowUnsupportedSystem = true. If the retry succeeds, update processing continues and the generated PR body notes that validation used the unsupported-system fallback. Other build failures still fail normally.

Related context

• Darwin package update support #513 tracks this specific Darwin-only update failure.
• darwin-aarch64 not supported #390 is related but distinct: it asks for Darwin flake/package support for nixpkgs-update itself, which this PR intentionally does not change.
• itsycal: 0.15.8 -> 0.15.10 nixpkgs#482647 is an example manual itsycal update created because the bot could not complete the Darwin-only package update.

Changes

• Add explicit allow-unsupported Nix option helpers while keeping default strict build options unchanged.
• Add BuildOutcome, unsupported host-platform detection, and buildForUpdate.
• Use buildForUpdate in the update flow.
• Include a short generated PR note only when fallback validation was used.
• Add unit coverage for detection, allow-unsupported options, and fallback PR body text.

Testing

• git diff --check
• Direct Hspec test binary: 14 examples, 0 failures
• nix flake check --all-systems passed locally from a clean temp copy containing this branch's working-tree changes.
• nix build .#checks.x86_64-linux.treefmt --no-link passed in isolated OrbStack amd64 Debian container.

Not completed locally:

• Full raw cabal test all: blocked in the ad-hoc macOS/mise setup because the doctest subprocess did not inherit the filtered package DB and could not see Polysemy.Plugin.
• Manual tart/itsycal end-to-end repro: isolated OrbStack amd64 required slow source builds under emulation, so I did not treat it as a useful quick validation path.

Formatter note:

• Repo-pinned treefmt check passes on x86_64-linux.
• nix fmt -- --ci is not supported by this repo's pinned treefmt version.
• On aarch64-darwin, building the repo-pinned ormolu-0.5.0.1 formatter failed with an output reference cycle (bin -> out -> bin), which appears to be old formatter/toolchain cache drift rather than formatting drift in this patch.