Tool-env

create { tools = [...] } builds a typed ToolEnvSpec from a list of raw { name; package } records; each is wrapped via mb.operations.tool so package is carried as a typed Thunk Derivation.

merge a b composes two envs — b overrides any a tool whose name matches. empty is the identity.