Add configless mode for child pipeline auto-discover

Summary

• Add child-pipelines.configless option to child-pipeline module
• When enabled, child flakes don't need their own .#gitlab-ci app
• Parent generates standard validation + build jobs per child flake:
  • validate:flake-show — nix flake show
  • validate:flake-lock — nix flake lock --no-update-lock-file
  • build:omnix — om ci run (builds all outputs)
• New mkChildPipelineYaml library function produces the child pipeline YAML as a Nix derivation
• Backwards compatible — existing mode (child flakes with .#gitlab-ci) unchanged

Enables nixica test flakes to be CI'd without any CI config in each test fixture.

Related: nixica!10, nixica#7