feat(store)!: port nexus-store to no_std (core+alloc) (#301)

[joeldsouzax]

Summary

• #![cfg_attr(not(feature = "std"), no_std)] + unconditional extern crate alloc behind an additive default std feature (mirrors [freeze][T1] no_std kernel: port nexus to core+alloc (public error bounds are freeze-relevant) — or drop the IoT claim #279 / feat(nexus)!: port kernel to no_std (core+alloc) (#279) #303; unlike the pure-core kernel, the store is alloc-dependent by design)
• Freeze gate: all public error bounds std::error::Error → core::error::Error (stable since 1.81; a re-export, so no semantic change for std consumers — but irreversible post-1.0 in the other direction)
• futures/bytes/aligned-vec flip to default-features = false at the workspace root (workspace inheritance cannot override default-features); every std consumer restores its exact former feature set locally — including five consumers beyond the issue's list found by the sweep, and nexus-fjall's futures line which previously compiled only via workspace-hack feature unification
• nexus-store joins hakari [final-excludes] — workspace-hack force-enables std-implying futures-util features (io/channel/sink) that unification would otherwise leak into the no_std build, making the gate a silent no-op
• New flake check nexus-store-nostd: host --no-default-features (in-crate std-leak detector), wasm32, and thumbv7em-none-eabihf — the issue assumed a bare-metal build needs a #[global_allocator], but that holds only for binaries; an rlib links no allocator, so the store gets the same strong gate as the kernel. The thumb gate also builds the dep-free feature set (subscription,export,import,snapshot,projection), empirically proven no_std-clean (the whole catch-up→live-tail loop rides futures' alloc-only surface)
• Optional codec features (json/rkyv/cbor) remain std-only by design — serde_json/rkyv/crc32c pull std today; follow-up card material

The ! is earned by the workspace default-feature flips (affects --no-default-features consumers of those deps), not by the bounds change.

Closes #301

Test plan

• nix flake check green including the new nexus-store-nostd gate (pre-commit hook, both commits)
• cargo nextest run -p nexus-store — 544/544, std path unchanged
• cargo clippy --all-features --all-targets — zero warnings
• thumbv7em/wasm32/host --no-default-features builds verified locally

🤖 Generated with Claude Code