18c7e0d5

Your first flake

Adds a `flake.nix` so the repo builds under Nix and can run on NixCI.

## What it does
- Builds with **crane** + the **oxalica rust-overlay** (x86_64-linux).
- Outputs: native CLI, static `x86_64-unknown-linux-musl` and cross
  `aarch64-unknown-linux-musl` release binaries, the wasm inspect UI, the npm
  package, plus `clippy`, `rustfmt` and the test suite — each as exactly one
  attribute (no duplicate builds).
- **One shared dependency derivation** (`packages.deps`). crane reduces its
  source to cargo metadata only (every `.rs` replaced by a stub), so editing
  source code never rebuilds dependencies.
- `wasm-bindgen-cli` pinned to `0.2.125` to match the `wasm-bindgen` crate
  (nixpkgs ships `0.2.121`).
- `nix-ci.nix` hand-specifies the build graph and disables automatic dependency
  discovery, so a no-op rebuild is as fast as possible.

Also reformats the `antithesis_sdk` workspace dependency to a single-line inline
table (strict TOML 1.0 rejects the multi-line form; cargo tolerates it).

## Verify dependency-cache stability yourself

This records the `deps` derivation path, makes a real edit to a Rust source
file, records the path again, and asserts the two are identical — proving a
source change does not rebuild dependencies. It reverts the edit afterwards.

```bash
#!/usr/bin/env bash
set -euo pipefail
cd "$(git rev-parse --show-toplevel)"

ATTR='.#deps'
VICTIM='lib/bombadil/src/lib.rs'

drv_path() { nix eval --raw "${ATTR}.drvPath"; }

before="$(drv_path)"
echo "deps derivation BEFORE: ${before}"

cleanup() { git checkout -- "${VICTIM}" 2>/dev/null || true; }
trap cleanup EXIT

printf '\n// experiment: this edit must not rebuild deps\npub fn _marker() {}\n' >>"${VICTIM}"
git --no-pager diff --stat -- "${VICTIM}"

after="$(drv_path)"
echo "deps derivation AFTER:  ${after}"

if [ "${before}" = "${after}" ]; then
  echo "PASS — a source change does not rebuild dependencies."
else
  echo "FAIL — the dependency derivation changed."; exit 1
fi
```

## CI
Passing on NixCI (production):
https://nix-ci.com/gh:NorfairKing:bombadil/your-first-flake