01a70ba3

Your first flake

Adds a `flake.nix` so the repo builds under Nix and can run on NixCI.

## What it does
- Builds with **crane** + the **oxalica rust-overlay** (x86_64-linux).
- Outputs: native CLI, static `x86_64-unknown-linux-musl` and cross
  `aarch64-unknown-linux-musl` release binaries, the wasm inspect UI, the npm
  package, plus `clippy`, `rustfmt` and the test suite — all wired into
  `nix flake check`.
- **One shared dependency derivation.** crane reduces its source to cargo
  metadata only (every `.rs` replaced by a stub), so editing source code never
  rebuilds dependencies. Proof you can run yourself:
  `./nix/experiments/deps-cache-stability.sh`.
- `wasm-bindgen-cli` pinned to `0.2.125` to match the `wasm-bindgen` crate
  (nixpkgs only ships `0.2.121`).

Also reformats the `antithesis_sdk` workspace dependency to a single-line inline
table: Nix's strict TOML 1.0 parser rejects the multi-line form (cargo tolerates
it). Semantically identical.

## CI
Passing on NixCI staging:
https://staging.nix-ci.com/gh:NorfairKing:bombadil/your-first-flake/9df6f7759f63a0b6ce06a4f47954766e2cac966e