[thebrandonlucas]

Replaces flake.nix/flake.lock with a Kaifile.roc on Kai 0.0.11 and a committed .kai/lock.json. The Kai shell matches the flake's:

• The Rust toolchain comes from rust-toolchain.toml through rust-overlay, plus llvm-tools-preview for the CRAP report (RustToolchainWith, new in 0.0.11).
• Python 3 and cargo-machete are added.
• On entry from the repository root, the shell runs cargo build --locked and puts target/debug on PATH. The flake's shellHook does the same; the Kaifile sets it with Raw("nix", "shell:default", ...).

.envrc, .gitignore, AGENTS.md (the friction-log repro.sh), docs/development.md and docs/quality.md are updated to match.

This PR is stacked on brandon/dev-2953-voltage-cli-add-environments-create.

Gaps against the flake

Gap	Effect
Kai 0.0.11 has no macOS release, and its flake builds only for Linux	The Kaifile declares Apple Silicon macOS and the shell works there, but a Mac can get Kai only by building it from source. docs/development.md sends macOS developers to rustup until a release exists. Intel macOS is not declared.
nixpkgs follows Kai's default nixos-unstable	The flake pinned nixos-26.05 to keep Intel macOS, which Kai does not support.

Verified

In a nixos/nix aarch64-linux container with Kai 0.0.11 (release tarball, checked against SHA256SUMS):

• kai check: Kaifile.roc is valid
• kai update created .kai/lock.json (nixpkgs 1d060086, rust-overlay 19e0e6c9)
• kai shell default -- ...: rustc 1.98.1, cargo-machete 0.9.2, Python 3.14.8, llvm-tools binaries in the sysroot, and voltage 0.2.0 from target/debug on PATH
• The full verification gate inside the shell: cargo fmt --check, clippy -D warnings, cargo machete, cargo test --locked (221 + 166 passed) and scripts/check-coverage.py all pass

On Apple Silicon macOS, with Kai 0.0.11 built from source as Kai's nightly CI builds it: kai check passes, kai update reports no input changed (declaring macOS leaves the lock as it is), and the shell and the full gate pass (rustc for aarch64-apple-darwin).

nix run/nix shell github:thebrandonlucas/kai/v0.0.11 both print 0.0.11 on aarch64-linux, as docs/development.md instructs.

These checks ran on this PR's tree: the one commit on top of brandon/dev-2953-voltage-cli-add-environments-create at 1748a5d. x86_64-linux was not run. This PR changes no Rust source, so the CRAP report was not rerun.

Note: in Docker Desktop containers, Roc fails to download the platform and std bundles (DownloadFailed). The cause is a last line of /etc/resolv.conf that holds only a space. Rewrite that file to its nameserver line, or put the bundles in ~/.cache/roc/packages/<hash>/ by hand.

Try it

On this branch, on Linux with Nix (flakes enabled):

nix shell github:thebrandonlucas/kai/v0.0.11
kai check
kai shell default -- rustc --version
kai shell default -- voltage --version

Expect: Kaifile.roc is valid; rustc 1.98.1; then the development voltage built from this checkout.

[tee8z]

Reviewed draft head bbc165d02f1e794b8d9e1e9f29522edfa4994dc7 against #123 at d6a4f611bb749183eec2f410004ff9f54bbfb533.

No blocking finding in this build-only diff. The configuration uses primitives present in Kai 0.0.11, preserves the pinned Rust toolchain, adds LLVM tools/Python/cargo-machete, commits the input lock, and retains the build-on-entry behavior. The loss of Intel macOS support and the macOS installation limitation are disclosed.

Independent validation on this head: verified the aarch64 Kai release against its SHA256SUMS; kai check passed. Formatting, full-target Clippy with warnings denied, dependency hygiene, contract/docs checks, and full cargo test --locked passed (222 unit + 166 integration tests). Shell syntax, lock JSON, and diff whitespace checks passed. No CRAP rerun is required for this layer because it changes neither src nor tests.

Limits: kai shell default -- rustc --version could not run because Nix is absent in this workspace. This checks the parser and Rust package, not the new shell, direnv activation, or other platforms. The PR remains a draft; this is a comment review, not an approval or a readiness change. The parent #123 still has its own unresolved findings.