feat: add Nix flake and Devbox support - #2970

What

Adds a flake.nix so the project can be installed and run directly from GitHub at the latest release:

nix run github:doublecmd/doublecmd
nix profile install github:doublecmd/doublecmd

The flake tracks the default branch and is auto-bumped to the latest release by a daily workflow, so github:doublecmd/doublecmd always serves the current release.

Adds a devbox.json for reproducible development environments:

devbox shell
devbox run build

Why

The nixpkgs#doublecmd package lags significantly behind upstream GitHub releases (nixpkgs is at 1.2.4 while GitHub releases are at 1.2.6). Users who want the latest release — including beta releases — have no Nix-based install path.

For users who already have Nix installed, a flake provides:

• One-command install / run — nix run github:doublecmd/doublecmd with no clone or manual build steps.
• Pure / Hermetic builds — every input (the prebuilt binary, glibc/libiconv) is pinned in flake.lock. If it builds today, it builds in ten years.
• Reproducible — the exact same derivation always produces the exact same output bit-for-bit. No "works on my machine."
• Idempotent installs — running nix profile install twice is a no-op.
• Rollback-able — nix profile rollback restores the previous profile generation instantly.
• Cross-platform — same invocation on macOS (Apple Silicon & Intel) and Linux. The flake handles platform-specific linking.
• Atomic upgrades / downgrades — profiles are switched atomically. No half-upgraded state.
• Clean uninstall — nix profile remove leaves no residue.

Changes

• flake.nix: Nix flake wrapping the prebuilt release tarball as packages.<system>.default and apps.<system>.default for x86_64-linux, aarch64-linux, x86_64-darwin, and aarch64-darwin.
• flake.lock: pinned nixpkgs-unstable input.
• .github/workflows/nix-release.yml: scheduled lag-check automation that auto-bumps version + per-platform sha256 hashes and opens a PR when flake.nix falls behind the latest release.
• devbox.json: Devbox configuration for reproducible development environments (with fpc and lazarus).
• .gitignore: Added Nix build result symlinks (/result, /result-*).
• README.md: Added Nix installation subsection.

Testing

Verified locally:

nix flake check --no-build
nix build .
nix run . -- --help

Builds and runs successfully on x86_64-darwin (macOS Intel). Reports version 1.2.6 beta correctly.

Notes

• The flake wraps the prebuilt release tarball rather than building from source, so it stays in sync with releases and avoids a full Free Pascal / Lazarus toolchain in the closure.
• Tag-pinning (github:.../vX.Y.Z) is not supported — release tags are cut before the bump workflow updates flake.nix. Use github:.../ (tracks default branch) or pin to a commit SHA.
• macOS DMG extraction uses p7zip since bsdtar cannot handle DMG format.
• No breaking changes to existing build paths.

Scope

The PR scope is well-contained — additive only, no existing functionality affected.

Related

Resolves #2969