Add Nix flake for mciasctl and mciasgrpcctl

Vendor dependencies and expose control program binaries via
nix build. Uses nixpkgs-unstable for Go 1.26 support.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

flake.nix

@@ -0,0 +1,34 @@
+{
+  description = "mcias - Metacircular Identity and Access Service";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+  };
+
+  outputs =
+    { self, nixpkgs }:
+    let
+      system = "x86_64-linux";
+      pkgs = nixpkgs.legacyPackages.${system};
+      version = "1.7.0";
+    in
+    {
+      packages.${system} = {
+        default = pkgs.buildGoModule {
+          pname = "mciasctl";
+          inherit version;
+          src = ./.;
+          vendorHash = null;
+          subPackages = [
+            "cmd/mciasctl"
+            "cmd/mciasgrpcctl"
+          ];
+          ldflags = [
+            "-s"
+            "-w"
+            "-X main.version=${version}"
+          ];
+        };
+      };
+    };
+}