feat: add flake app, dev shell, direnv, and checks (task 0002)

Layer the remaining flake outputs onto the build: a default app pointing at
the compiled binary, a dev shell exposing the pinned Bun, biome, and bun2nix,
a `use flake` .envrc for direnv, and a checks set aggregating the Bun test
tiers, a build-seam smoke check against the Nix-built binary, and biome lint
through the treefmt-nix flake-parts module.

The dev shell and the build share the one pinned nixpkgs-bun input so Bun
cannot drift between them. treefmt's biome reuses the repo's biome.json with
VCS disabled for the sandbox, and packages/core/src/index_test.ts is
reformatted by biome so the new lint gate is green.

flake.nix

@@ -4,9 +4,9 @@
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
 
-    # Provides the single pinned Bun used to compile the binary, held apart
-    # from `nixpkgs` so a `nixpkgs` update cannot drag Bun to a release that
-    # emits empty binaries under sandboxed native compilation.
+    # The single pinned Bun, used to compile the binary and to develop against.
+    # It is held apart from `nixpkgs` so a `nixpkgs` update cannot pull in a Bun
+    # release that emits empty binaries under sandboxed native compilation.
     nixpkgs-bun.url = "github:nixos/nixpkgs/241313f4e8e508cb9b13278c2b0fa25b9ca27163";
 
     flake-parts.url = "github:hercules-ci/flake-parts";
@@ -19,6 +19,11 @@
       inputs.nixpkgs.follows = "nixpkgs-bun";
       inputs.systems.follows = "systems";
     };
+
+    treefmt-nix = {
+      url = "github:numtide/treefmt-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
@@ -26,6 +31,8 @@
     inputs.flake-parts.lib.mkFlake { inherit inputs; } {
       systems = import inputs.systems;
 
+      imports = [ inputs.treefmt-nix.flakeModule ];
+
       perSystem =
         { system, ... }:
         let
@@ -33,9 +40,65 @@
             inherit system;
             overlays = [ inputs.bun2nix.overlays.default ];
           };
+
+          # The Bun from the same pinned `nixpkgs-bun` the build compiles with.
+          bun = inputs.nixpkgs-bun.legacyPackages.${system}.bun;
+
+          kitchen = pkgs.callPackage ./package.nix { };
+
+          bunDeps = pkgs.bun2nix.fetchBunDeps { bunNix = ./bun.nix; };
         in
         {
-          packages.default = pkgs.callPackage ./package.nix { };
+          # Share the overlaid package set with the imported modules.
+          _module.args.pkgs = pkgs;
+
+          packages.default = kitchen;
+
+          apps.default = {
+            type = "app";
+            program = "${kitchen}/bin/kitchen";
+          };
+
+          devShells.default = pkgs.mkShell {
+            packages = [
+              bun
+              pkgs.biome
+              pkgs.bun2nix
+            ];
+          };
+
+          treefmt = {
+            projectRootFile = "flake.nix";
+            programs.biome = {
+              enable = true;
+              # Reuse the repo's biome configuration as the single source.
+              # The sandboxed check has no git tree, so biome's VCS-ignore
+              # lookup must be off.
+              settings = pkgs.lib.recursiveUpdate (pkgs.lib.importJSON ./biome.json) {
+                vcs.enabled = false;
+              };
+              # Skip re-validating the config; biome consumes it directly.
+              validate.enable = false;
+            };
+          };
+
+          checks = {
+            tests = pkgs.bun2nix.mkDerivation {
+              pname = "kitchen-tests";
+              inherit (kitchen) version;
+              src = ./.;
+              inherit bunDeps;
+              dontRunLifecycleScripts = true;
+              dontUseBunBuild = true;
+              doCheck = true;
+              installPhase = "touch $out";
+            };
+
+            smoke = pkgs.runCommand "kitchen-smoke" { } ''
+              ${kitchen}/bin/kitchen --help
+              touch $out
+            '';
+          };
         };
     };
 }