feat(nix): package gitea-axi as a flake with a PATH-suffixing wrapper (task 0037)

Add a flake at the repository root exposing gitea-axi as a package, with the
derivation in its own callable expression so it stays buildable outside a flake
context and usable in an overlay unchanged.

Dependencies are fetched from the lockfile's integrity fields via importNpmLock
rather than a committed fixed-output hash, and the version is read from the
package manifest, so neither a dependency bump nor a release edits any Nix
expression. The source is an explicit allowlist, keeping ADR, spec, task and
bench churn out of the derivation's inputs.

The installed binary is wrapped with --suffix PATH per ADR 0018: the operator's
own git and tea win, and the closure's are a fresh-machine fallback.

Two things differ from the plan. Systems coverage is three targets, not four:
nixpkgs 26.11 dropped x86_64-darwin and now throws on evaluating it, which
would break nix flake show and nix flake check for every system at once. And
buildNpmPackage supplies no check hook, so doCheck alone was silently inert and
produced a green build whose tests never ran; running the fast tier needs an
explicit checkPhase.

flake.nix

@@ -0,0 +1,31 @@
+{
+  description = "Agent-ergonomic CLI for Gitea issues and pull requests";
+
+  # Tracks unstable to match the maintainer's system. Consumers deduplicate by
+  # pointing this input at their own nixpkgs, so it governs standalone builds
+  # only — never the deployed artifact.
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+
+  outputs =
+    { self, nixpkgs }:
+    let
+      # x86_64-darwin is deliberately absent: nixpkgs 26.11 dropped it, and
+      # `legacyPackages.x86_64-darwin` now throws rather than merely failing to
+      # build — so listing it would break `nix flake show` and `nix flake check`
+      # for every system, not just that one. Intel macOS needs the 26.05 branch.
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "aarch64-darwin"
+      ];
+
+      forAllSystems =
+        f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
+    in
+    {
+      packages = forAllSystems (pkgs: rec {
+        gitea-axi = pkgs.callPackage ./package.nix { };
+        default = gitea-axi;
+      });
+    };
+}