Adds flake.nix and flake.lock for Nix users.
- Inputs: NixOS/nixpkgs nixpkgs-unstable, pinned by commit + narHash for supply-chain integrity
- Targets: aarch64/x86_64 × darwin/linux
- buildPhase calls Makefile.cbm cbm directly because scripts/build.sh's `file`-based compiler detection fails on Nix (cc is a wrapper script there); Nix stdenv already guarantees the correct compiler + target arch
- Dev shell adds pkg-config + libgit2 so the optional libgit2 acceleration in pass_githistory.c is picked up via pkg-config
Opt-in: non-Nix users see no behaviour change. flake.nix and flake.lock are inert unless `nix build` or `nix develop` is invoked.
Joseph Voss