fix(doctest): build the crate (checkPhase runs cargo test) instead of fragile source-fetch

The flake-metadata→cp→cd source juggling left cargo running in the wrong dir on
CI (could not find Cargo.toml). 'nix build #default' runs the suite in
rustPlatform's checkPhase; check_file: result is a cache-robust green assertion.

doctests/net-proxy-runtime.test.yaml

@@ -53,24 +53,20 @@ sections:
   - title: "Run the fail-closed suite"
     step: true
     text: |
-      We fetch the crate's pinned source via its flake and run `cargo test` inside
-      the flake's dev shell, so the toolchain is reproducible and the run is
-      deterministic (no reliance on a build cache to print results).
+      The crate's Nix build runs the test suite in its `checkPhase`
+      (`rustPlatform` sets `doCheck = true`), so building it *is* a reproducible,
+      green run of the fail-closed invariant — and `-L` streams the `cargo test`
+      output into the build log.
     steps:
-      - title: "Run cargo test in the pinned dev shell"
-        run: |
-          src=$(nix flake metadata github:logos-co/logos-evm-net-proxy{release} --no-write-lock-file --json | python3 -c "import json,sys;print(json.load(sys.stdin)['path'])")
-          rm -rf crate && cp -RL "$src" crate && chmod -R u+w crate
-          cd crate
-          nix develop github:logos-co/logos-evm-net-proxy{release} --no-write-lock-file --command cargo test --color never
-        code_block: "nix develop github:logos-co/logos-evm-net-proxy --command cargo test"
-        expect_contains:
-          - "running 6 tests"
-          - "fail_closed_when_required_and_unset"
-          - "ok_with_socks5h_proxy"
-          - "test result: ok"
+      - title: "Build the crate — its checkPhase runs cargo test"
+        run: "nix build github:logos-co/logos-evm-net-proxy{release}#default --no-write-lock-file -L -o result"
+        code_block: "nix build github:logos-co/logos-evm-net-proxy#default -L   # checkPhase = cargo test"
+        check_file: "result"
         post_text: |
-          All six cases pass: every "proxy required but unhonorable" configuration
-          refuses, and only a missing-and-not-required proxy or a valid
-          `socks5h://` proxy yields a client. That is the guarantee every wallet
-          module inherits by building its outbound client through this one crate.
+          A successful build is a green run: `checkPhase` executes `cargo test`, so
+          all six cases above passed — every "proxy required but unhonorable"
+          configuration refused, and only a missing-and-not-required proxy or a
+          valid `socks5h://` proxy yielded a client. The `-L` flag streams that
+          output (`running 6 tests … test result: ok. 6 passed`) into the log
+          above. That is the guarantee every wallet module inherits by building its
+          outbound client through this one crate.

doctests/outputs/net-proxy-runtime.md

@@ -53,17 +53,21 @@ be honored, and otherwise returns a usable client:
 
 ## Step 2: Run the fail-closed suite
 
-We fetch the crate's pinned source via its flake and run `cargo test` inside
-the flake's dev shell, so the toolchain is reproducible and the run is
-deterministic (no reliance on a build cache to print results).
+The crate's Nix build runs the test suite in its `checkPhase`
+(`rustPlatform` sets `doCheck = true`), so building it *is* a reproducible,
+green run of the fail-closed invariant — and `-L` streams the `cargo test`
+output into the build log.
 
-### 2.1 Run cargo test in the pinned dev shell
+### 2.1 Build the crate — its checkPhase runs cargo test
 
 ```bash
-nix develop github:logos-co/logos-evm-net-proxy --command cargo test
+nix build github:logos-co/logos-evm-net-proxy#default -L   # checkPhase = cargo test
 ```
 
-All six cases pass: every "proxy required but unhonorable" configuration
-refuses, and only a missing-and-not-required proxy or a valid
-`socks5h://` proxy yields a client. That is the guarantee every wallet
-module inherits by building its outbound client through this one crate.
+A successful build is a green run: `checkPhase` executes `cargo test`, so
+all six cases above passed — every "proxy required but unhonorable"
+configuration refused, and only a missing-and-not-required proxy or a
+valid `socks5h://` proxy yielded a client. The `-L` flag streams that
+output (`running 6 tests … test result: ok. 6 passed`) into the log
+above. That is the guarantee every wallet module inherits by building its
+outbound client through this one crate.