Add a Nix flake that builds Pi from the checkout on aarch64/x86_64 Linux
and macOS. The build is offline: provider model data is hydrated from a
pi.dev model catalog revision pinned in nix/model-catalog.json, and the
runtime dependency tree comes from packages/coding-agent/install-lock with
internal packages built from source.
The Nix workflow keeps the catalog pin current on main, builds release
tags on all systems, and fast-forwards the stable branch to each release
that builds. The release script refreshes the pin before tagging.
Fresh package installs could give bundled model catalog
files newer filesystem mtimes than the remote catalog’s Last-Modified timestamp,
causing Pi to ignore newer remote models.
Use the catalog’s recorded generation time instead of installation-dependent file metadata.
