feat: introduced nix packaging and path-based binary resolution

- Add comprehensive Nix flake definitions, derivations, modules, and CI workflows.
- Update tests and executables to resolve binaries from PATH rather than absolute paths.
- Ensure byte reproducibility and zeroed timestamps in embedded dashboard archives.
- Add handling for Nix-managed installations in CLI update checks.

scripts/gen-nix-bun.ts

@@ -0,0 +1,27 @@
+#!/usr/bin/env bun
+
+import * as path from "node:path";
+import { $ } from "bun";
+import { $which } from "../packages/utils/src/which";
+
+const repoRoot = path.join(import.meta.dir, "..");
+
+/** Regenerate the checked-in Bun dependency expression with the pinned bun2nix input. */
+export async function generateNixBunDeps(): Promise<void> {
+	const bun2nix = $which("bun2nix");
+	if (bun2nix) {
+		await $`${bun2nix} -l bun.lock -c ../ -o nix/bun.nix`.cwd(repoRoot);
+		return;
+	}
+
+	const nix = $which("nix");
+	if (!nix) {
+		throw new Error("Generating nix/bun.nix requires bun2nix from `nix develop`, or Nix to enter that shell.");
+	}
+
+	await $`${nix} --extra-experimental-features ${"nix-command flakes"} --accept-flake-config develop --command bun2nix -l bun.lock -c ../ -o nix/bun.nix`.cwd(
+		repoRoot,
+	);
+}
+
+if (import.meta.main) await generateNixBunDeps();

scripts/release.ts

@@ -11,6 +11,7 @@
 import { $, Glob } from "bun";
 import { compareVersions } from "../packages/utils/src/version.ts";
 import { runChangelogFixer } from "./fix-changelogs";
+import { generateNixBunDeps } from "./gen-nix-bun";
 
 const changelogGlob = new Glob("packages/*/CHANGELOG.md");
 const packageJsonGlob = new Glob("packages/*/package.json");
@@ -341,6 +342,7 @@ async function cmdRelease(versionOrBump: string): Promise<void> {
 	await $`rm -f bun.lock`;
 	await $`bun install`;
 	await $`cargo generate-lockfile`;
+	await generateNixBunDeps();
 	console.log();
 
 	// 5. Update changelogs