Add Nix flake for mciasctl and mciasgrpcctl

Vendor dependencies and expose control program binaries via
nix build. Uses nixpkgs-unstable for Go 1.26 support.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

vendor/github.com/golang-migrate/migrate/v4/database/util.go

@@ -0,0 +1,33 @@
+package database
+
+import (
+	"fmt"
+	"hash/crc32"
+	"strings"
+	"sync/atomic"
+)
+
+const advisoryLockIDSalt uint = 1486364155
+
+// GenerateAdvisoryLockId inspired by rails migrations, see https://goo.gl/8o9bCT
+func GenerateAdvisoryLockId(databaseName string, additionalNames ...string) (string, error) { // nolint: golint
+	if len(additionalNames) > 0 {
+		databaseName = strings.Join(append(additionalNames, databaseName), "\x00")
+	}
+	sum := crc32.ChecksumIEEE([]byte(databaseName))
+	sum = sum * uint32(advisoryLockIDSalt)
+	return fmt.Sprint(sum), nil
+}
+
+// CasRestoreOnErr CAS wrapper to automatically restore the lock state on error
+func CasRestoreOnErr(lock *atomic.Bool, o, n bool, casErr error, f func() error) error {
+	if !lock.CompareAndSwap(o, n) {
+		return casErr
+	}
+	if err := f(); err != nil {
+		// Automatically unlock/lock on error
+		lock.Store(o)
+		return err
+	}
+	return nil
+}