ci: add nix flake and use in CI

Using system tooling can lead to weird behavior of available Node
versions, for example this IPv6 resolution error:
```
[3/5] Fetching packages...
error Error: connect EHOSTUNREACH 2606:4700::6810:1922:443
    at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1495:16)
```

flake.nix

@@ -0,0 +1,35 @@
+{
+  description = "Nix flake development shell.";
+
+  inputs = {
+    nixpkgs.url = "nixpkgs/nixos-25.05";
+  };
+
+  outputs =
+    { self, nixpkgs }:
+    let
+      supportedSystems = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
+      forEachSystem = nixpkgs.lib.genAttrs supportedSystems;
+      pkgsFor = forEachSystem (system: import nixpkgs { inherit system; });
+    in
+    rec {
+      formatter = forEachSystem (system: pkgsFor.${system}.nixpkgs-fmt);
+
+      devShells = forEachSystem (system: {
+        default = pkgsFor.${system}.mkShellNoCC {
+          packages = with pkgsFor.${system}.buildPackages; [
+            git        # 2.44.1
+            openssh    # 9.7p1
+            yarn       # 1.22.22
+            nodejs_20  # v20.15.1
+            ghp-import # 2.1.0
+          ];
+        };
+      });
+    };
+}