feat: introduced nix packaging and path-based binary resolution

- Add comprehensive Nix flake definitions, derivations, modules, and CI workflows.
- Update tests and executables to resolve binaries from PATH rather than absolute paths.
- Ensure byte reproducibility and zeroed timestamps in embedded dashboard archives.
- Add handling for Nix-managed installations in CLI update checks.

crates/pi-builtins/src/ifne.rs

@@ -255,35 +255,35 @@ mod tests {
 	#[cfg(unix)]
 	#[test]
 	fn nonempty_stdin_runs_command_with_stdin() {
-		let result = run_in("hello world\n", &["/bin/cat"]);
+		let result = run_in("hello world\n", &["cat"]);
 		assert_eq!(result, (0, "hello world\n".to_string(), String::new()));
 	}
 
 	#[cfg(unix)]
 	#[test]
 	fn empty_stdin_skips_command() {
-		let result = run_in("", &["/bin/sh", "-c", "echo ran"]);
+		let result = run_in("", &["sh", "-c", "echo ran"]);
 		assert_eq!(result, (0, String::new(), String::new()));
 	}
 
 	#[cfg(unix)]
 	#[test]
 	fn invert_runs_command_on_empty_stdin() {
-		let result = run_in("", &["-n", "/bin/sh", "-c", "echo ran"]);
+		let result = run_in("", &["-n", "sh", "-c", "echo ran"]);
 		assert_eq!(result, (0, "ran\n".to_string(), String::new()));
 	}
 
 	#[cfg(unix)]
 	#[test]
 	fn invert_passes_nonempty_stdin_through() {
-		let result = run_in("data\n", &["-n", "/bin/sh", "-c", "echo ran"]);
+		let result = run_in("data\n", &["-n", "sh", "-c", "echo ran"]);
 		assert_eq!(result, (0, "data\n".to_string(), String::new()));
 	}
 
 	#[cfg(unix)]
 	#[test]
 	fn child_exit_code_propagates() {
-		let result = run_in("x", &["/bin/sh", "-c", "exit 3"]);
+		let result = run_in("x", &["sh", "-c", "exit 3"]);
 		assert_eq!(result, (3, String::new(), String::new()));
 	}
 
@@ -299,7 +299,7 @@ mod tests {
 	#[test]
 	fn early_exiting_child_is_not_an_error() {
 		let big = "a".repeat(1 << 20);
-		let result = run_in(&big, &["/usr/bin/head", "-c", "1"]);
+		let result = run_in(&big, &["head", "-c", "1"]);
 		assert_eq!(result, (0, "a".to_string(), String::new()));
 	}
 

crates/pi-builtins/src/pgrep.rs

@@ -36,7 +36,7 @@ mod tests {
 
 	#[cfg(unix)]
 	fn matching_process() -> std::process::Child {
-		std::process::Command::new("/bin/sleep")
+		std::process::Command::new("sleep")
 			.arg("30")
 			.spawn()
 			.expect("spawn matching process")

crates/pi-builtins/src/sed.rs

@@ -7930,7 +7930,7 @@ fn re_or_saved_re<'a>(
 
 #[cfg(unix)]
 fn shell_command(cmd: &str, host: &Host) -> std::process::Command {
-	let mut c = std::process::Command::new("/bin/sh");
+	let mut c = std::process::Command::new("sh");
 	c.arg("-c").arg(cmd);
 	// run relative to the shell's cwd,
 	// not the host process cwd. `output()` already keeps the child's stdio