fix: make cabal.project.stage1 hermetic (:none + pin happy/alex/hpc)

[angerman]

Make cabal.project.stage1 hermetic

stage1 was missing active-repositories: :none and an explicit build-tool pin,
while stage2 and stage3 both have them. So stage1's build-tools —
happy/happy-lib/alex for the compiler's Parser.y / Lexer.x — resolved from
Hackage and floated to the newest version.

This was latent: it only broke once happy-2.1.7 was published upstream.
After that, stage1 resolved + built happy-lib-2.1.7, whose generated parser
uses happyDoParse, which mismatches the pinned 2.1.5 happy template and fails
to compile (genprimopcode, GHC-44432: happyDoParse … lacks an accompanying binding). CI that had been green started failing across platforms with no
source change — purely the upstream happy release. It also leaks into the
wasm/JS cross stage3, where the build-stage genprimopcode picks up the same
floated happy.

Fix

Give stage1 the same hermeticity as stage2/stage3: active-repositories: :none

• explicit alex-3.5.2.0 / happy-2.1.5 / happy-lib-2.1.5 / hpc-0.7.0.2
  URLs (versions match the other stages). hpc is a dependency of ghc whose
  bootstrap-installed version wants the old directory, conflicting with the
  pinned directory-1.3.10.0, so it must be provided as source too.

Validation

Verified on the modern-pin branch: with this change stage1's solver plans
happy-2.1.5 (not 2.1.7) and stage1 + stage2 genprimopcode build cleanly
(happyParse, no GHC-44432).

NOTE: stable-ghc-9.14's own CI is separately broken — its stage* cabal pin
is the branch name stable-haskell/master (not a SHA), which doesn't resolve.
That's pre-existing and unrelated to this one-file hermeticity fix.