feat(nix): add flake for the standalone Linux binary

[manuc66]

What

Adds a Nix flake so the standalone Linux binaries shipped since v1.11.0 can be used directly from the repository:

nix run github:manuc66/node-hp-scan-to
nix profile install github:manuc66/node-hp-scan-to

• flake.nix exposes packages.default/packages.node-hp-scan-to and apps.default for x86_64-linux and aarch64-linux; the version is read from package.json.
• packaging/nix/package.nix downloads the released linux-x64/linux-arm64 tarball, installs the binary plus the default config (NODE_CONFIG_DIR) and docs, and keeps the binary byte-identical.

Why the launcher

Two properties of the bun-compiled binary drive the packaging:

1. Any ELF rewrite (strip, which nixpkgs runs by default on $out/lib, or patchelf) silently destroys the app bundle bun appends to the executable — the binary then degrades to a plain bun CLI. The derivation therefore sets dontStrip = true and never patches it.
2. It hardcodes the interpreter /lib64/ld-linux-x86-64.so.2, which does not exist on NixOS. Instead of patching, the wrapper runs the binary through the nixpkgs glibc loader (ld-linux-* --library-path …), which needs no programs.nix-ld and no FHS environment.

Automating Nix Hashes

To ensure nix run works immediately after a release (without the hashes being "one version behind"), the release process has been updated:

• Pre-built Linux binaries: Linux binaries are now built during the Release workflow (or locally via release.sh).
• SRI Hashes: scripts/update-nix-hashes.sh calculates the SRI hashes of these binaries and updates packaging/nix/package.nix before the version commit and tag.
• Artifact passing: The pre-built binaries are passed from the Release workflow to the Publish workflow via GitHub artifacts. This ensures the hashes committed to Git match the final assets bit-for-bit, despite bun build --compile being non-deterministic.

Evidence (already verified, in a Nix 2.35 container)

Check	Result
nix flake check --all-systems	all checks passed! (x86_64 + aarch64, packages + apps)
nix build .#default	builds
nix run .# -- single-scan --help	prints the app help
nix run .# -- discover --json	runs; mDNS probe works (No HP scan-capable device found in the container, expected)
nix profile install .#default + run	works
Binary byte-identity	installed sha256 d4bb2766… matches the release tarball binary
Config resolution	no "No configurations found" warning (NODE_CONFIG_DIR resolved)

Checklist

Done:

• nix flake check --all-systems passes
• build + run on x86_64-linux
• nix run and nix profile install
• installed binary byte-identical to release tarball
• config resolution via NODE_CONFIG_DIR
• aarch64 derivation evaluates
• signed commit
• automated Nix hash updates in release workflows

To do / not yet verified:

• Real NixOS machine (so far tested only in a Nix container)
• Real aarch64-linux realization (derivation evaluated only, no aarch64 builder/emulation here)
• Real printer smoke test through the flake binary (single-scan / listen / adf-autoscan / discover)
• Decide binary vs source build (community feedback on Nix #1545)