feat: add Nix flake support for one-command installation

[levonk]

Summary

This issue tracks adding Nix flake support to the upstream project so users can install and run it without cloning or compiling manually.

What Nix provides

• Pure / Hermetic builds: every input — compiler, libraries, system dependencies — is pinned in flake.lock. If it builds today, it builds in ten years.
• Reproducible: the exact same derivation always produces the exact same output bit-for-bit (modulo timestamps). No "works on my machine."
• Idempotent installs: running nix profile install twice is a no-op. The system reaches the declared state and stays there.
• Rollback-able: nix profile rollback restores the previous profile generation instantly. Broken update? One command back.
• Declarative: the entire build is a single expression (flake.nix). No imperative apt install, brew install, make dance.
• Cross-platform: same nix run github:modiqo/cliare works on macOS (Apple Silicon & Intel) and Linux. The flake handles platform-specific dependencies.
• Zero-install runs: nix run fetches from binary cache when available. No clone, no compile, no cargo build.
• No system pollution: nix profile install adds to a user-specific profile. Uninstall cleanly with nix profile remove. No orphaned global packages.
• Atomic upgrades / downgrades: profiles are switched atomically. No half-upgraded state.

Current gap

The project currently documents source builds (cargo install --path .) and a prebuilt-binary installer script. There is no one-command install path for users who already have Nix.

Proposed change

• Add flake.nix wrapping the prebuilt release tarball as packages.<system>.cliare (plus default), and apps.<system>.cliare (plus default), for x86_64/aarch64 linux and darwin.
• Add devbox.json for reproducible development environments.
• Update README install section to include Nix (flakes) and Devbox instructions.
• Add a scheduled lag-check workflow (.github/workflows/nix-release.yml) that auto-bumps the pinned version and per-platform SRI hashes when flake.nix falls behind the latest release. This is required because releases are created with GITHUB_TOKEN, which does not start new workflow runs, so a release: published trigger would silently never fire.

Note: this is a Prebuilt Tarball flake, so tag-pinning (github:modiqo/cliare/vX.Y.Z) is not supported — release tags are cut before the bump workflow updates flake.nix. Use github:modiqo/cliare (tracks default branch) or pin to a commit SHA for reproducibility.

Branch

feat-nix-package-manager-install on the fork.

Implementation

I have prepared the implementation in my fork at:
https://github.com/levonk/cliare/tree/feat-nix-package-manager-install

The changes include:

• flake.nix: Nix flake wrapping the prebuilt release tarball as packages.<system>.cliare/default and apps.<system>.cliare/default.
• flake.lock: pinned nixpkgs-unstable input.
• .github/workflows/nix-release.yml: scheduled lag-check automation that auto-bumps version + per-platform sha256 hashes and opens a PR when flake.nix falls behind the latest release.
• devbox.json: Devbox configuration for reproducible development environments.
• .gitignore: Added Nix build result symlinks.
• README.md: Added Nix and Devbox installation subsections.
• CHANGELOG.md: Added Unreleased changelog entry.

Tested locally with nix flake check --no-build, nix build ., nix run . -- --help, and nix run .#cliare -- --help.