direnv: enter the flake's dev shell on hosts with Nix

`.envrc` runs `use flake` when Nix is present, so on the NixOS hosts
(programs.direnv.enable brings direnv and nix-direnv) cd'ing into a
clone gives the pinned Rust toolchain, clippy, rustfmt, cargo-deny and
make; on titan, which has no Nix, it does nothing. nix-direnv's cache,
.direnv/, is ignored. Checked on straylight in a throwaway copy:
cargo 1.95.0, cargo-deny 0.19.6, rustc from the Nix store.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.envrc

@@ -0,0 +1,7 @@
+# Enter the flake's dev shell (the Rust toolchain, clippy, rustfmt, cargo-deny, make) on hosts with
+# Nix and direnv. NixOS hosts get both from `programs.direnv.enable`, which turns on nix-direnv and
+# caches the shell under .direnv/. Run `direnv allow` once in each clone. Hosts without Nix (titan)
+# are left alone.
+if has nix; then
+  use flake
+fi

.gitignore

@@ -6,6 +6,7 @@
 # Local secrets and accounts (for example mattermost.env): never commit.
 *.env
 
-# Nix build outputs.
+# Nix build outputs, and nix-direnv's cached dev shell.
 /result
 /result-*
+/.direnv/

docs/dependencies.md

@@ -34,3 +34,5 @@ owner's NixOS hosts run, so a host's config can use the flake with
 - `nix build` builds every binary (`result/bin/`); the tests are not run there, only in `make gate`.
 - `nix build .#tools-image` builds the tool containers' image (`deploy/tools-image.nix`).
 - `nix develop` gives a shell with `cargo`, `rustc`, `clippy`, `rustfmt`, `cargo-deny` and `make`.
+- With direnv (NixOS: `programs.direnv.enable`), `.envrc` enters that shell on `cd`; run
+  `direnv allow` once per clone. It does nothing on a host without Nix.