Add Nix flake for mciasctl and mciasgrpcctl

Vendor dependencies and expose control program binaries via
nix build. Uses nixpkgs-unstable for Go 1.26 support.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

vendor/github.com/golang-migrate/migrate/v4/Dockerfile

@@ -0,0 +1,26 @@
+FROM golang:1.25-alpine3.21 AS builder
+ARG VERSION
+
+RUN apk add --no-cache git gcc musl-dev make
+
+WORKDIR /go/src/github.com/golang-migrate/migrate
+
+ENV GO111MODULE=on
+
+COPY go.mod go.sum ./
+
+RUN go mod download
+
+COPY . ./
+
+RUN make build-docker
+
+FROM alpine:3.21
+
+RUN apk add --no-cache ca-certificates
+
+COPY --from=builder /go/src/github.com/golang-migrate/migrate/build/migrate.linux-386 /usr/local/bin/migrate
+RUN ln -s /usr/local/bin/migrate /migrate
+
+ENTRYPOINT ["migrate"]
+CMD ["--help"]