Migrate the development shell to a locked Nix flake

This pull request replaces the channel-sensitive nix-shell entrypoint with a locked flake used consistently by direnv, CI, and generated-reference automation. It preserves the existing toolchain and environment behavior while removing the implicit <nixpkgs> search-path lookup.