Add one optional, cell-aware `argsFor` resolver to `craneMultiBuild` so projects can select dependency artifacts for each existing target cell without changing Flakebox's manual Cargo-cross model. Resolve common project arguments once per cell before profile mapping and merge them through the existing `overrideArgs`/`mergeArgs` path. Preserve existing callbacks, selectors, output paths, and behavior when callers omit the resolver.

### Details

Attach explicit dependency-role contexts to built-in toolchains. Native cells expose the native `pkgsBuildHost`, `pkgsHostTarget`, and `pkgsBuildBuild` roles; ordinary Nixpkgs cross cells expose those roles from their cross package set. Android and `wasm32-unknown-unknown` expose no false target universe, and `capabilities.targetBuildInputs` is derived from the availability of the target-library role. Missing role access reports the toolchain/cell and role lazily, so custom toolchains without a context remain usable until their resolver requests scoped packages.

Document the public resolver contract, existing merge precedence, and the explicit-artifact boundary of the manual Cargo-cross model. Add evaluation coverage for native and x86_64-to-AArch64 role selection, custom/wasm/Android contextual diagnostics, capability-based filtering, three-layer argument precedence, Darwin portability, and exactly one resolver invocation per cell rather than per profile. The observable invocation-count and exception-text contracts use a compact, documented nested-evaluator adapter because pure Nix cannot expose either property; all package-role, capability, and merge behavior remains tested against the real enhanced Crane library.

Add an x86_64-to-AArch64 behavioral check with a small OpenSSL Rust binary. It asserts that `argsFor` selects `pkgsBuildHost.pkg-config` and `pkgsHostTarget.openssl`, executes the selected pkg-config wrapper, completes Crane dependency and package builds, and inspects the resulting binary, its `NEEDED` libssl entry, its target-OpenSSL `RUNPATH`, and libssl itself as AArch64 ELF artifacts.

A comprehensive architecture, judgment, maintainability, and reliability review initially found Darwin-incompatible test selection, inaccurate `depsBuildBuild` merge documentation, weak invocation/capability/diagnostic coverage, and duplicated capability state. Those issues were fixed and re-review passed. A later inline review correctly noted that the first evaluator fixture reproduced too much Crane and merge infrastructure; it was replaced with the minimal adapter described above, and re-review passed. Review of the behavioral check found that its first path assertion was not confined to `RUNPATH`; the check now extracts and verifies that entry specifically, and final re-review passed with no remaining findings.

`nix build -L .#checks.x86_64-linux.craneMultiBuildTests`, `nix build -L .#checks.x86_64-linux.cellAwareCrossInputs`, all four supported-system focused check evaluations, `nix flake check --no-build --no-write-lock-file`, treefmt, and selfci pass. The behavioral link check became feasible after the independent cross-linker compression fix merged on master; this change contains no linker-policy workaround.