[clowders]

Summary

• Default nullkomma.r.allowOffNixpkgs to true while preserving false as an explicit opt-out.
• Demonstrate a locked GitHub Remote without opt-in and document the broader build surface.
• Keep source pinning and hash requirements unchanged.

Validation

• nix develop --command check nix-unit
• nix develop --command tasks all
• nix flake check (Linux systems omitted as incompatible with this host)

Closes #257

[clowders]

Investigated both failing consumer-contract checks:

• Run 40422334225, job 121919535214: nix develop --command check-fixtures fails during dev-shell/task evaluation while fetching dataheld/maxheld revision 83c05ac1282b2add9516117102c2a561d709b27e; GitHub archive endpoint returns HTTP 404.
• Run 40422296421, job 121919408922: the same command and archive fail with the same HTTP 404 before fixtures execute.

Both are pre-existing, with one shared private-input access cause, not failures introduced by this PR. Repository metadata confirms dataheld/maxheld is private. Main commit 76ddf79 already fails identically in run 40411158830, job 121881884698. The private input, lockfile, dogfood configuration, partition and workflows are unchanged in this PR; its diff only changes R defaults, related tests, fixture configuration and documentation.

Local validation: nix develop --command check-fixtures passed (exit 0); nix develop --command tasks also succeeded. Local success does not establish that a fresh hosted runner can fetch the private source.

Follow-up: existing issue #261 tracks restoring CI private-input access/isolation without weakening checks. Fix that separately, then rerun both checks. No code changes, commit or push are needed for this investigation. tasks all and nix flake check were not run because no code changed. Hosted downstream checks remain skipped, so their results remain unknown.