docs: plan Nix flake packaging (spec, ADR 0018, tasks 0036-0042)

Add the design record for distributing gitea-axi as a Nix flake: a
package, a development shell, and a checks output, plus the continuous
integration changes that come with it.

ADR 0018 records the wrapper's deference to the operator's own `git` and
`tea` — the reverse of the hermetic instinct, chosen because `tea`
refreshes OAuth tokens in place and so must not have two versions
mutating one credential store.

Also records the `tea`-is-still-a-runtime-dependency gotcha, which ADR
0002's title obscures.

.claude/tasks/0041-ci-flake-build-job.md

@@ -0,0 +1,20 @@
+---
+spec: nix-flake-packaging
+blocked-by: 0037-flake-package-and-wrapper
+---
+
+## What to build
+
+A separate continuous-integration job that builds the flake, on both push and pull request.
+
+Its value is detecting flake rot — most concretely, a build-relevant file omitted from the source allowlist — at the commit that causes it rather than weeks later at the maintainer's next system rebuild.
+
+It is deliberately non-gating for the other jobs, so an infrastructure problem with Nix availability on the runner does not block an otherwise legitimate change.
+Its cost is honest and accepted: because the checks output aliases the package, this job re-runs the fast tier inside the derivation and, without a warm store, rebuilds the whole dependency closure.
+
+## Acceptance criteria
+
+- [ ] A distinct job builds the flake on push and on pull request.
+- [ ] Its failure does not block or fail the other jobs.
+- [ ] Removing a build-relevant file from the source allowlist makes this job fail.
+- [ ] The job's cost and its non-gating intent are stated in the workflow so neither reads as an oversight.