8568a6b3

Your first flake

Adds a `flake.nix` so the repo builds under Nix and can run on NixCI.

## What it does
- Builds with **crane** + the **oxalica rust-overlay** (x86_64-linux).
- Outputs: native CLI, static `x86_64-unknown-linux-musl` and cross
  `aarch64-unknown-linux-musl` release binaries, the wasm inspect UI, the npm
  package, plus `clippy`, `rustfmt` and the test suite — all wired into
  `nix flake check`.
- **One shared dependency derivation.** crane reduces its source to cargo
  metadata only (every `.rs` replaced by a stub), so editing source code never
  rebuilds dependencies. Proof you can run yourself:
  `./nix/experiments/deps-cache-stability.sh`.
- `wasm-bindgen-cli` pinned to `0.2.125` to match the `wasm-bindgen` crate
  (nixpkgs only ships `0.2.121`).

Also reformats the `antithesis_sdk` workspace dependency to a single-line inline
table: Nix's strict TOML 1.0 parser rejects the multi-line form (cargo tolerates
it). Semantically identical.

## CI
Passing on NixCI staging:
https://staging.nix-ci.com/gh:NorfairKing:bombadil/your-first-flake/9df6f7759f63a0b6ce06a4f47954766e2cac966e

Suite timing

Time to Start Worker time Duration Time to finish Idle
Config 0s 2s 2s 2s 0s
Eval 2s 1m11s 1m11s 1m14s 0s
Build 46s 24s 25s 1m12s 0s
Suite 0s 1m38s 1m13s 1m14s 0s

Timeline

0s10s20s30s40s50s1m1m10s