nix: pin nixpkgs in flake.lock, and make every entry point read it

[alycda]

shell.nix said import <nixpkgs> {}: the same tool set for everyone, whatever versions each machine's channel held. One afternoon of building three tracks showed what that costs — R 4.5.3 in the container and 4.6.1 on the flake registry, Godot 4.6.3 and 4.7.2, gfortran 15.2 and 15.3, all "current nixpkgs" on the same day — so every version a README cites was true on exactly one machine.

flake.lock now names one revision, nixos-26.05 at c3eea5b2 (2026-09-14), and the pin reaches every door that goes through shell.nix:

nix develop            the workshop shell (five required tools)
nix develop .#full     plus every library the default-off features link
nix-shell              the same derivation — shell.nix reads flake.lock
nix-shell --arg full true, direnv's `use nix`, shell.nix in a devcontainer, CI

What the pin does not reach: the devcontainers' home-manager profiles. .devcontainer/*/home.nix takes pkgs from the container's own channel, which the nix feature sets and setup.sh leaves alone. That is a second nixpkgs, and it is why the wasm variant reads its wasm-bindgen-cli version out of days/Cargo.lock instead of trusting either. Pointing home-manager at this lock is the natural next step, not this PR.

shell.nix stays the single definition; flake.nix is a thin door onto it, and shell.nix's default nixpkgs is a fetchTarball of the locked revision with the lock's own narHash. Nothing that runs shell.nix had to change, and nothing needs flakes enabled — the devcontainer's nix has nix-command off and stays that way. .envrc watches the lock so nix flake update reaches direnv.

A release branch rather than unstable, on purpose: bumps become a diff someone reads. 26.05 carries what the tracks need — rustc past gdext's 1.94 floor, Godot 4.6 (the api-4-6 floor), R, gfortran, LAPACK.

Not taken: the earlier attempt on claude/flake-pinned-environment (six shells, nix/shells.nix, per-track floors by construction). Right shape, five weeks stale, and it moved the definition out of shell.nix. Per-track shells are the natural next commit on top of this one.

Verified

• nix-instantiate shell.nix and nix eval .#devShells.<system>.default.drvPath name the same .drv; same for --arg full true against .#full.
• nix flake check --no-build --all-systems passes, both darwin systems included.
• nix develop opens the pinned shell (rustc 1.95.0, cargo 1.95.0, cbindgen 0.29.4, just 1.51.0); nix-shell --arg full true answers the ffi job's full pkg-config roll call with lapack, R 4.5.3 present.
• CI on this branch: Rust and Verify both green, including the ffi job on macOS at the pin and the Fortran cell on macOS, previously unobserved.

🤖 Generated with Claude Code