feat: add flake app, dev shell, direnv, and checks

Layer the remaining flake outputs onto the build: a default app pointing at
the compiled binary, a dev shell exposing the pinned Bun, biome, and bun2nix,
a `use flake` .envrc for direnv, and a checks set aggregating the Bun test
tiers, a build-seam smoke check against the Nix-built binary, and biome lint
through the treefmt-nix flake-parts module.

The dev shell and the build share the one pinned nixpkgs-bun input so Bun
cannot drift between them. treefmt's biome reuses the repo's biome.json with
VCS disabled for the sandbox, and packages/core/src/index_test.ts is
reformatted by biome so the new lint gate is green.

flake.lock

@@ -118,7 +118,8 @@
         "flake-parts": "flake-parts_2",
         "nixpkgs": "nixpkgs",
         "nixpkgs-bun": "nixpkgs-bun",
-        "systems": "systems"
+        "systems": "systems",
+        "treefmt-nix": "treefmt-nix_2"
       }
     },
     "systems": {
@@ -156,6 +157,26 @@
         "repo": "treefmt-nix",
         "type": "github"
       }
+    },
+    "treefmt-nix_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1784369104,
+        "narHash": "sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "df3c0640565d04a0261253cdd89fce78ec50168a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
     }
   },
   "root": "root",