ci: keep code-maat and its JRE out of the ci shell; nix-build takes them from .#repo-stats-tools (improvise-1xfb.5.1)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze

.github/workflows/ci.yml

@@ -148,7 +148,8 @@ jobs:
   # leaves Cargo.lock alone rebuilds only the workspace crates it changed.
   #
   # The repo-stats pipeline runs here because it needs this job's binary:
-  # `nix shell .#improvise` reuses the build above instead of a second one.
+  # `.#repo-stats-tools` is that build plus code-maat and its JRE, which stay
+  # out of the ci shell every other job enters.
   # Its suite gates; the report on a push to main never fails the build, and
   # its step fails only when improvise refuses the pipeline's input
   # (context/code/tooling.md section 7). Full history is for the report.
@@ -162,13 +163,13 @@ jobs:
       - name: nix build .#improvise
         run: nix build --print-build-logs .#improvise
       - name: The repo-stats pipeline computes what it claims to
-        run: nix shell .#improvise --command ./scripts/checkers.sh --ci nix-build
+        run: nix shell .#repo-stats-tools --command ./scripts/checkers.sh --ci nix-build
       - name: Churn, coupling and doc-growth report (report only)
         if: github.event_name == 'push'
         continue-on-error: true
         run: |
           rc=0
-          nix shell .#improvise --command ./scripts/repo-stats --out repo-stats > repo-stats.txt || rc=$?
+          nix shell .#repo-stats-tools --command ./scripts/repo-stats --out repo-stats > repo-stats.txt || rc=$?
           { echo '```'; cat repo-stats.txt; echo '```'; } >> "$GITHUB_STEP_SUMMARY"
           exit "$rc"
       - name: Upload the repo-stats model and its CSVs