build: package the kitchen CLI as a Nix flake

Add a flake-parts flake whose default package Bun-compiles the kitchen
CLI into a self-contained native binary, built in the sandbox with
dependencies vendored by bun2nix.

Bun is pinned via a dedicated nixpkgs-bun input (Bun 1.3.13) that
bun2nix follows, so nixpkgs can track unstable without moving the
compile toolchain onto a release that emits empty binaries.

bun2nix is both a flake input and an npm devDependency, and a
postinstall hook keeps the checked-in bun.nix in sync with the lockfile.

package.json

@@ -9,10 +9,12 @@
   "scripts": {
     "test": "bun test",
     "lint": "biome check .",
-    "format": "biome check --write ."
+    "format": "biome check --write .",
+    "postinstall": "bun2nix -o bun.nix"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.5.3",
-    "bun-types": "latest"
+    "bun-types": "latest",
+    "bun2nix": "^2.1.2"
   }
 }