Re-add it-rejects-outdated-lock test fixture
Summary
Re-adds the it-rejects-outdated-lock test fixture that was removed in !68 (merged) (nixica 0.9.0 update).
The previous approach failed because nix flake lock doesn't re-resolve already-locked inputs. The new approach uses a flake.nix with an unlocked flake-compat input that is absent from the flake.lock. When nix flake lock runs, it resolves and adds this input, causing git diff --exit-code to fail. The expect-failure module then verifies the rejection.
Closes #12