nix: a flake that builds every binary, the tool image and a dev shell

Follows the owner's other projects (sift, tether): nixpkgs pinned to
nixos-26.05, x86_64-linux, the version from the commit. `packages.default`
builds all six binaries with rustPlatform (tests stay in `make gate`),
`packages.tools-image` is deploy/tools-image.nix, and `devShells.default`
has Rust 1.95.0, clippy, rustfmt, cargo-deny and make. No NixOS module
yet: that is M8 (P22).

Checked on straylight: `nix flake check` passes; `nix build` gives
brokerd, bxctl, gatewayd, inferproxy, loopd and toolkit, each printing
its usage; `nix build .#tools-image` and `nix develop` work.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -61,6 +61,8 @@ requests, check `GET /slots?model=ornith-1.5-35b-a3b` so you do not evict someon
   any work done, and report the exit status and last lines.
 - Single test: `cargo test -p <crate> <test_name>`.
 - `make audit` runs `cargo deny check advisories`; it needs the network.
+- `nix build` (on a host with Nix, such as straylight) builds every binary; `nix build
+  .#tools-image` the tool image; `nix develop` gives the toolchain. See `docs/dependencies.md`.
 - `make verify-device` (from M2a task 13) runs the ignored tests in `crates/loopd/tests/device.rs`
   against straylight through a private `inferproxy`. It uses Ornith slot 0. `tools/check-m3a-device.sh`
   runs `brokerd`, `loopd` and an approval end to end against it.