build(nix): a devshell, so the justfile's cargo is really there

[bdelanghe]

There is no rustup on the machines this repo gets worked on, so cargo is simply absent: every just recipe and every gate in scripts/quality_gates.sh dies at command not found, and the 1.94.0 pin in rust-toolchain.toml is inert because rustup is what reads it.

Ported from empathic/lobby, whose flake solves the same problem.

What's in the shell

Beyond the Rust toolchain, it carries what the non-Rust gates need — _all_gates=(format shellcheck clippy test doc examples plugin site) reaches well past cargo:

tool	why
shellcheck	its gate errors out rather than skipping when absent
nodejs, pnpm	the site gate runs pnpm install --frozen-lockfile && pnpm run build; the format gate shells out to npx prettier
jq, curl	plugins/claude-code/scripts
fzf	so the pickers take their external-backend path while developing, not the embedded skim fallback

openssl is split across nativeBuildInputs (pkg-config) and buildInputs because openssl-sys arrives under git2 and needs pkg-config to find the dev output. ensure-path.sh already falls back from sha256sum to shasum, so no coreutils.

devShell only. bdelanghe/empathic-nix already builds path-cli by pinning a rev of this repo; a second recipe here would be a second thing to keep in step.

Verified in the shell

cargo build --workspace                                    ok
quality_gates.sh format shellcheck plugin site doc examples 6/6 PASS

Two known reds, both pre-existing and out of scope

1. clippy fails. nixpkgs ships Rust 1.97; the pin is 1.94.0. 1.97 enforces unnecessary_sort_by on crates/toolpath-pi/src/reader.rs:359, which 1.94 does not. The flake documents this divergence rather than papering over it — the pinned toolchain is the real gate, and green-in-the-shell is evidence, not proof. A one-line sort_by_key fix would close it; deliberately not bundled here.

2. test fails — 20 of 62 in path-cli --test integration — if you have CLAUDE_CONFIG_DIR set. Not a nix issue and not new: the tests sandbox HOME but never clear CLAUDE_CONFIG_DIR, so since b31f2c5 taught the reader to honour it, the CLI escapes the sandbox and reads the developer's real Claude config.

Error: Conversation not found: /Users/bobby/.config/claude/projects/-tmp-nix-shell-.../session-abc.jsonl
                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^ should have been the test's temp HOME

Proof it is orthogonal to this PR:

cargo test -p path-cli --test integration                    20 failed
env -u CLAUDE_CONFIG_DIR cargo test -p path-cli --test integration    62 passed, 0 failed

The fix belongs in ScopedHome (clear CLAUDE_CONFIG_DIR alongside HOME/XDG_DATA_HOME), as its own PR. Anyone who is not a Claude Code user never sees this.

---

1. Independent PR — no bundled or speculative changes
   • Verified: one commit, three files, all new except a CLAUDE.md section. The clippy lint and the test-isolation bug are both left alone.
2. Changed codepaths verified — targeted unit and full integration tests
   • Verified: format, shellcheck, plugin, site, doc, examples gates pass inside the shell; cargo build --workspace succeeds; cargo test passes 62/62 with CLAUDE_CONFIG_DIR cleared
3. Root cause identified — every failure traced to source
   • cargo absent because no rustup is installed and no devShell existed; the two remaining reds traced to a toolchain version gap and an env var escaping the test sandbox, neither introduced here
4. No duplication — refactoring preferred over copy/paste
   • devShell only; the package build stays in empathic-nix rather than being restated
5. No unrelated changes — housekeeping isolated to its own branch
   • The sort_by_key lint fix and the ScopedHome fix are both deliberately left for their own branches

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

🔍 Preview deployed: https://a715cda3.toolpath.pages.dev