Integrate nixpks build

[nully0x]

What and why

Checklist

• scripts/gate.sh passes (builds HEAD, not just the working tree)
• [N/A] New SQL is read-only; no EXPLAIN ANALYZE; findings stay deterministic (computed in Go)
• No PII enters a model.Context / --json / the store
• [ N/A] --json change is additive, or model.SchemaVersion bumped + schema regenerated (go run ./tools/schemagen)
• [N/A] A new finding has a docs/findings/<id>.md page + catalog entry

nix: flake packaging (go_1_27, v0.8.1) + non-blocking nix CI

Adds nix packaging so nix build .#pgbot / nix run .#pgbot works, plus an
informational nix build in CI. Rebased on current main; hashes recomputed for v0.8.1.

Packaging (flake.nix, package.nix)

• buildGoModule pinned to go_1_27: nixpkgs-unstable's default go (1.26.x)
  can't satisfy the module's go 1.27 directive
• ldflags = -X main.version= → packaged binary reports pgbot version 0.8.1, not dev
• devShell (nix develop) ships go 1.27.1 + golangci-lint

CI (.github/workflows/ci.yml)

• new nix build job with continue-on-error: true — vendorHash changes at each
  release tag, so a stale hash must annotate, never block a PR

Incidental: scripts/gate.sh local clone now uses --no-hardlinks — the
hardlink step fails on tmpfs TMPDIR (tmpfs /tmp, nix develop, WSL2). Cost
is one ~12 MB copy, freed on exit. Also gitignores /result.

Validation

• nix build .#pgbot → ./result/bin/pgbot --version → pgbot version 0.8.1
• nix develop -c scripts/gate.sh green (build, vet, golangci-lint, tests, 4 cross-builds)

closes #31

[nully0x]

last track of this is adding maintainer details for submission to nixpkgs.

[nully0x]

hi @alexshapalov checking in if there is any other actions on this PR.

[alexshapalov]

Merged — thanks for this, and sorry for the wait.

On the maintainer details: those are only needed for the upstream nixpkgs submission, not for the flake living here, so they were never blocking this PR. I will add the handle when we actually submit.

One follow-up if you are up for it. package.nix fetches the published tag, so nix build .#pgbot builds the v0.8.1 tarball rather than the working tree. Two consequences: the CI job stays green no matter what lands on main, and version, src.hash and vendorHash all need a hand bump on every release or the flake silently keeps shipping 0.8.1.

Could you make packages.pgbot build from self (or lib.cleanSource ./.) so nix build tests HEAD, and keep the fetchFromGitHub derivation as the nixpkgs-bound one? That would make the CI job mean something. Happy to open an issue to track it if you would rather not carry it.

Also nice catch on the gate.sh hardlink fix — unrelated to nix, but a real bug.

[nully0x]

I can pick up the followup issue, kindly create the issue and I will fix it.

Also, are you up to submit to nixpks? the package.nix file here suffice for it. though I already have a branch for that on my machine. Let me know what you think.

Thanks