build: package the kitchen CLI as a Nix flake

Add a flake-parts flake whose default package Bun-compiles the kitchen
CLI into a self-contained native binary, built in the sandbox with
dependencies vendored by bun2nix.

Bun is pinned via a dedicated nixpkgs-bun input (Bun 1.3.13) that
bun2nix follows, so nixpkgs can track unstable without moving the
compile toolchain onto a release that emits empty binaries.

bun2nix is both a flake input and an npm devDependency, and a
postinstall hook keeps the checked-in bun.nix in sync with the lockfile.

flake.nix

@@ -0,0 +1,41 @@
+{
+  description = "kitchen — the KitchenMD CLI, packaged as a Nix flake";
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+
+    # Provides the single pinned Bun used to compile the binary, held apart
+    # from `nixpkgs` so a `nixpkgs` update cannot drag Bun to a release that
+    # emits empty binaries under sandboxed native compilation.
+    nixpkgs-bun.url = "github:nixos/nixpkgs/241313f4e8e508cb9b13278c2b0fa25b9ca27163";
+
+    flake-parts.url = "github:hercules-ci/flake-parts";
+
+    systems.url = "github:nix-systems/x86_64-linux";
+
+    bun2nix = {
+      url = "github:nix-community/bun2nix?ref=2.1.2";
+      # Compile against the pinned Bun rather than `nixpkgs`'s.
+      inputs.nixpkgs.follows = "nixpkgs-bun";
+      inputs.systems.follows = "systems";
+    };
+  };
+
+  outputs =
+    inputs:
+    inputs.flake-parts.lib.mkFlake { inherit inputs; } {
+      systems = import inputs.systems;
+
+      perSystem =
+        { system, ... }:
+        let
+          pkgs = import inputs.nixpkgs {
+            inherit system;
+            overlays = [ inputs.bun2nix.overlays.default ];
+          };
+        in
+        {
+          packages.default = pkgs.callPackage ./package.nix { };
+        };
+    };
+}