build(nix): add reproducible package and dev shell

[pmarreck]

Summary

• add a pinned flake.lock and multi-system Nix flake
• fetch the Aube dependency cache in a fixed-output derivation, then build fully offline
• install a production-only dependency graph and compile node-pty with Nixpkgs tooling
• expose a Node 26/Aube development shell
• check the packaged CLI with a real PTY-spawn probe

Verification

• nix flake check on x86_64-linux
• nix flake check --all-systems --no-build
• declared systems: x86_64-linux, aarch64-linux, aarch64-darwin
• installed package size: 169 MiB; x86_64-linux closure: 928.7 MiB

The smoke check inspects the structured doctor --json result directly because an absent optional Playwright browser makes the overall doctor command nonzero even when PTY spawning succeeds.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 546f02264e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Derive the Nix package version from package.json

When the next automated release updates package.json, this hard-coded value—and the duplicate cache version at line 52—will remain 0.5.0, because release-please-config.json:10 only registers README.md as an extra versioned file. The resulting Nix package will therefore expose stale derivation metadata even though the bundled CLI reports the new version; derive this value from package.json or add both occurrences to the release update process.

Useful? React with 👍 / 👎.