Add Nix flake for CLI, relay, and desktop installation

[levonk]

Summary

Adds a Nix flake so Buzz can be installed through the Nix package manager without requiring a Rust toolchain or Node.

• buzz-cli and buzz-relay: built from source via rustPlatform.buildRustPackage from the repo's Cargo.lock. Available on x86_64-linux, aarch64-linux, x86_64-darwin, and aarch64-darwin.
• buzz-desktop (default): built from source via cargo-tauri + pnpm + native dependencies (WebKitGTK, GStreamer, sherpa-onnx, etc.). Works on all four standard platforms including aarch64-linux. This matches the approach used by PRs feat: first-class Nix support (flake, CI-relay, multi-platform) #3434 and nix support for desktop and relay #3734.
• buzz-desktop-prebuilt (alternative): wraps the prebuilt release artifacts (macOS .app.tar.gz and Linux .AppImage) where they exist. Faster to install, but not available on all platforms and cannot be patched.
• devShell: Rust toolchain + PostgreSQL + Redis for local development via nix develop.
• CI workflow (.github/workflows/nix.yml): build checks for CLI, relay, both desktop variants on Linux and Darwin, plus a scheduled daily job that tracks desktop-v* releases and opens PRs to bump hashes when a new desktop release ships.

Platform support

Package	x86_64-linux	aarch64-linux	x86_64-darwin	aarch64-darwin
buzz-cli	source	source	source	source
buzz-relay	source	source	source	source
buzz-desktop (default)	source	source	source	source
buzz-desktop-prebuilt	prebuilt AppImage	not available	prebuilt .app.tar.gz	prebuilt .app.tar.gz

x86_64-darwin uses a pinned pre-drop nixpkgs revision (5f85796ab70f9a6ac935b366065d4565288947ac, 2026-05-31) because nixos-unstable (26.11) dropped Intel Darwin support. Nixpkgs 26.05 will be the last release to support x86_64-darwin.

Usage

# CLI
nix run github:block/buzz#buzz-cli -- --help
nix profile install github:block/buzz#buzz-cli

# Relay
nix run github:block/buzz#buzz-relay -- --help
nix profile install github:block/buzz#buzz-relay

# Desktop (source build — default)
nix run github:block/buzz#buzz-desktop

# Desktop (prebuilt — faster, but not on all platforms)
nix run github:block/buzz#buzz-desktop-prebuilt

# Development shell
nix develop github:block/buzz

Design decisions

• Source build as default for desktop: Matches the approach in PRs feat: first-class Nix support (flake, CI-relay, multi-platform) #3434 and nix support for desktop and relay #3734. Source builds are the idiomatic Nix approach — they allow patching, work on all platforms, and are reproducible. The prebuilt option is kept as an alternative for faster installation.
• Prebuilt as alternative: buzz-desktop-prebuilt wraps release artifacts for users who want fast installation on platforms with a prebuilt binary.
• Source build for CLI/relay: No standalone release artifacts exist for buzz-cli or buzz-relay, so they are built from source via Nix's buildRustPackage.
• Sherpa-onnx static libraries: Fetched per-platform from the k2-fsa/sherpa-onnx GitHub releases. Hashes pinned in nix/versions.nix.
• Sidecar binaries: The desktop source build compiles sidecar binaries (buzz-acp, buzz-agent, buzz-dev-mcp, git-credential-nostr, buzz-cli) and places them in the Tauri binaries directory.
• Two Cargo vendor hashes: The workspace root Cargo.lock and desktop/src-tauri/Cargo.lock are vendored separately via rustPlatform.fetchCargoVendor.
• Pnpm hash: The pnpm dependency hash is pinned in nix/versions.nix. It may need adjustment if the nixpkgs pnpm version differs from the one used to compute it.

Files added

• flake.nix — flake outputs (packages, apps, checks, devShells)
• flake.lock — pinned inputs
• nix/buzz.nix — desktop source build expression (cargo-tauri + pnpm + sidecars + sherpa-onnx)
• nix/versions.nix — pinned versions and hashes (sherpa-onnx, cargo vendor, pnpm)
• .github/workflows/nix.yml — CI with build checks and scheduled hash automation
• README.md — Nix installation documentation

Test plan

• nix build .#buzz-cli succeeds on x86_64-darwin
• nix run .#buzz-cli -- --help prints help
• nix build .#buzz-relay succeeds on x86_64-darwin
• nix run .#buzz-relay starts (fails on DB connection as expected without Postgres)
• nix build .#buzz-desktop-prebuilt succeeds on x86_64-darwin
• nix flake check --no-build passes
• Flake evaluates for both buzz-desktop and buzz-desktop-prebuilt on x86_64-darwin
• CI validates buzz-desktop source build on x86_64-linux and aarch64-darwin
• CI validates buzz-desktop-prebuilt on x86_64-linux and aarch64-darwin
• Pnpm hash matches nixpkgs pnpm version (may need adjustment on Linux CI)