fix(nix): only expose the expert launcher

[sophiathedev]

removes start_expert from the nix package before fixup wraps the executables. that script calls bin/plain, which the nix derivation renames to bin/expert, so exposing it gives users a broken entry point. plain/source builds keep their existing launcher.

adds an install check that only expert is public in bin and is executable. hidden nix wrapper files are left intact.

validation with the locked nixpkgs revision, Nix 2.35.2 in a Linux ARM64 container:

• nix build .#expert --no-link --print-out-paths --option sandbox false — passed, including the install check
• nixfmt --check nix/expert.nix — passed
• git diff --check — passed
• before the fix, the public executable check failed and start_expert --help exited 127 because bin/plain was missing; after the fix, only expert is exposed

separate runtime observation: expert --help entered an Erlang shell on both the pre-fix and patched packages in this container, so i'm not claiming a successful CLI smoke test. this PR only changes the exported launcher set.

closes #429