build(nix): reproducible dev + build env via a flake (ADR-0049)

Root flake with two outputs: devShells.default (pinned 1.95.0
toolchain via rust-toolchain.toml + rust-overlay, plus cargo-sweep)
and packages.default (rustPlatform.buildRustPackage from the committed
Cargo.lock; doCheck=false). flake.lock pins nixpkgs nixos-26.05 /
rust-overlay / flake-utils. .envrc (use flake) for direnv parity.

Single source of toolchain for dev and the upcoming CI, so they can't
drift. Verified through the flake: nix build yields a working binary,
clippy clean, 2424 tests pass / 0 fail / 1 intentional ignored doctest.
First step toward requirements.md TT5 + D1/D2/D3.

rust-toolchain.toml

@@ -0,0 +1,10 @@
+[toolchain]
+# Pinned to an exact stable release (not the floating "stable" channel) so
+# `nix flake update` cannot surprise-bump Rust into new clippy lints that would
+# fail the `-D warnings` CI gate. Matches the host toolchain and the datamage
+# flake's convention (its ADR 0046). Bump deliberately, in its own commit.
+channel = "1.95.0"
+# rustfmt + clippy back the `fmt`/`clippy` CI stages; no coverage or WASM
+# tooling is needed here (pure-Rust TUI). Cross-compilation targets for the
+# eventual D1 release matrix are added when that CI lands, not before.
+components = ["rustfmt", "clippy"]