build: package the kitchen CLI as a Nix flake

Add a flake-parts flake whose default package Bun-compiles the kitchen
CLI into a self-contained native binary, built in the sandbox with
dependencies vendored by bun2nix.

Bun is pinned via a dedicated nixpkgs-bun input (Bun 1.3.13) that
bun2nix follows, so nixpkgs can track unstable without moving the
compile toolchain onto a release that emits empty binaries.

bun2nix is both a flake input and an npm devDependency, and a
postinstall hook keeps the checked-in bun.nix in sync with the lockfile.

package.nix

@@ -0,0 +1,19 @@
+# The `kitchen` CLI compiled to a self-contained native binary.
+{ lib, bun2nix }:
+bun2nix.mkDerivation {
+  pname = "kitchen";
+  version = (lib.importJSON ./packages/bin/package.json).version;
+
+  src = ./.;
+
+  module = "packages/bin/src/index.ts";
+
+  bunDeps = bun2nix.fetchBunDeps {
+    bunNix = ./bun.nix;
+  };
+
+  # No vendored dependency needs install-time lifecycle scripts, and running
+  # them would fire this repo's own `postinstall` (bun2nix) inside the sandbox,
+  # where it is redundant.
+  dontRunLifecycleScripts = true;
+}