Add Nix flake for mciasctl and mciasgrpcctl

Vendor dependencies and expose control program binaries via
nix build. Uses nixpkgs-unstable for Go 1.26 support.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

vendor/github.com/golang-migrate/migrate/v4/Dockerfile.github-actions

@@ -0,0 +1,11 @@
+FROM alpine:3.19
+
+RUN apk add --no-cache ca-certificates
+
+COPY migrate /usr/local/bin/migrate
+
+RUN ln -s /usr/local/bin/migrate /usr/bin/migrate
+RUN ln -s /usr/local/bin/migrate /migrate
+
+ENTRYPOINT ["migrate"]
+CMD ["--help"]