build(nix): add reproducible package and dev shell

[pmarreck]

Summary

• add a pinned flake.lock and multi-system Nix flake
• fetch the Aube dependency cache in a fixed-output derivation, then build fully offline
• install a production-only dependency graph and compile node-pty with Nixpkgs tooling
• expose a Node 26/Aube development shell
• check the packaged CLI with a real PTY-spawn probe

Verification

• nix flake check on x86_64-linux
• nix flake check --all-systems --no-build
• declared systems: x86_64-linux, aarch64-linux, aarch64-darwin
• installed package size: 169 MiB; x86_64-linux closure: 928.7 MiB

The smoke check inspects the structured doctor --json result directly because an absent optional Playwright browser makes the overall doctor command nonzero even when PTY spawning succeeds.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 546f02264e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Derive the Nix package version from package.json

When the next automated release updates package.json, this hard-coded value—and the duplicate cache version at line 52—will remain 0.5.0, because release-please-config.json:10 only registers README.md as an extra versioned file. The resulting Nix package will therefore expose stale derivation metadata even though the bundled CLI reports the new version; derive this value from package.json or add both occurrences to the release update process.

Useful? React with 👍 / 👎.

[ThomasK33]

Thanks for this PR. I'm going to decline it, though.
I don't use Nix (anymore), and the tools in this repo are installed and pinned through mise, which also sets up the dev shell.
A flake would add a second source of truth for which tool runs at which version, and I don't want to maintain both.

Findings from testing, in case they help an out-of-tree flake:

1. The dependency hash isn't reproducible. nix flake check fails with a fixed-output hash mismatch, and rebuilds produce different hashes. The cause is that aube fetch writes cache/aube/adaptive-state.json with a concurrency value tuned to network timing. With that file removed, the hash is stable.
2. It's already stale. chore: fix CI setup (aube relock) and clear high-severity audit advisories #168 changed the lockfile, so the hash no longer matches main.
3. The version is hard-coded. (lib.importJSON ./package.json).version would keep it in sync with releases.

With the hash fixed, the package built on x86_64-linux and a real session worked.

Heads-up: we're potentially moving from aube to pnpm (#176), so the dependency fetch would need to switch to pnpm. A flake in nixpkgs or your own repo is the better home for this.