feat(nix): add Nix flake for building, developing, and containerizing OpenShell

[randomizedcoder]

Summary

Hi there! This PR adds Nix flake support so that people on NixOS (and anyone using Nix) can build, develop, and containerize OpenShell directly.

We recently raised NVIDIA/NemoClaw#727 which integrates OpenShell into NemoClaw — but in that repo we had to pull in the OpenShell container image rather than building it more directly. With this PR merged, NemoClaw (and other Nix-based projects) could build and use OpenShell as a native Nix dependency instead.

We'd love for this to be useful to the community. Feedback very welcome!

What's Included

• flake.nix coordinates modular Nix files under ./nix/
• Builds all 3 binaries (openshell, openshell-server, openshell-sandbox)
• Dev shell provides rustc, cargo, clippy, rustfmt, protoc, kubectl, helm
• OCI container image via dockerTools (~48 MiB compressed, ~131 MiB uncompressed, non-root)
• 15 container smoke tests via nix run .#container-test
• Source filtering for reproducible builds without .git or target/
• README covers usage, architecture, tested results, and an honest sandboxing comparison between Nix and OpenShell
• .gitignore updated for /result symlink

Quick Start

nix build                    # Build all 3 binaries
nix run -- --version         # Run openshell
nix develop                  # Enter dev shell
nix build .#container        # Build OCI container image
nix run .#container-test     # Run 15 smoke tests

Full details in nix/README.md.

Related

• feat(nix): add Nix flake for reproducible builds and containers NemoClaw#727 — NemoClaw Nix integration (currently uses the OpenShell container; this PR would let it build OpenShell directly)

Testing

• nix build produces all 3 binaries
• nix run -- --version outputs openshell 0.0.0
• nix develop -c rustc --version confirms rustc 1.94.0
• nix build .#container produces ~48 MiB compressed / ~131 MiB uncompressed image
• nix run .#container-test passes 15/15 structural checks
• nix fmt -- --check passes on all Nix files

[github-actions]

Thank you for your interest in contributing to OpenShell, @randomizedcoder.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[randomizedcoder]

#560

[randomizedcoder]

I have read the DCO document and I hereby sign the DCO.

[randomizedcoder]

recheck