ci: keep code-maat and its JRE out of the ci shell; nix-build takes them from .#repo-stats-tools (improvise-1xfb.5.1)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze

scripts/checkers.sh

@@ -101,7 +101,7 @@ ci_suites() {
   case "$1" in
     build) echo assemble-stamp ;;
     js) echo node-test ;;
-    # Needs the improvise binary, which only this job builds (tooling.md section 7).
+    # Needs improvise and code-maat, which only this job has (tooling.md section 7).
     nix-build) echo repo-stats ;;
     # check-harness-lock must never read "could not resolve" as "stale" (improvise-zs2r).
     kb) echo kb checkers pr-watch release-preflight pr-reviews fmt-workspaces bd-audit-ids check-harness-lock agent-git ;;