Add Nix flake for reproducible dev and CI/CD

- flake.nix pins the full toolchain (asciidoctor + pdf/epub3/diagram/
  mathematical, plantuml, graphviz, jre, vale, epubcheck) via bundlerEnv
- Gemfile/Gemfile.lock/gemset.nix lock the Ruby gems; work around the
  vendored mtex2MML cmake_minimum_required incompatibility
- 'nix build' produces book.pdf + book.epub; 'nix develop' gives a shell
  where all existing make targets work
- CI/CD workflows now install Nix and build/lint/validate through the flake
- devcontainer uses Nix; add .envrc for direnv; document in README

Co-authored-by: Shelley <shelley@exe.dev>

flake.nix

@@ -0,0 +1,83 @@
+{
+  description = "letterpress - a self-publishing book template built on Asciidoctor";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { self, nixpkgs, flake-utils }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = import nixpkgs { inherit system; };
+
+        # Ruby gem environment pinned by Gemfile.lock + gemset.nix.
+        # The native `mathematical` gem (pulled in by asciidoctor-mathematical)
+        # needs a bunch of C libraries + bison/flex to build its bundled lasem.
+        gems = pkgs.bundlerEnv {
+          name = "letterpress-gems";
+          ruby = pkgs.ruby_3_4;
+          gemdir = ./.;
+          # nixpkgs' defaultGemConfig already knows how to build the tricky
+          # native `mathematical` gem (bison/flex/cmake + rpath fixups). We only
+          # extend it: the gem vendors an mtex2MML whose CMakeLists declares an
+          # ancient cmake_minimum_required that modern cmake rejects, so allow it.
+          gemConfig = pkgs.defaultGemConfig // {
+            mathematical = attrs:
+              (pkgs.defaultGemConfig.mathematical attrs) // {
+                CMAKE_POLICY_VERSION_MINIMUM = "3.5";
+              };
+          };
+        };
+
+        # Everything needed to render the book: the gem env plus the external
+        # binaries asciidoctor-diagram shells out to (plantuml -> java + graphviz).
+        runtimeInputs = with pkgs; [
+          gems
+          gems.wrappedRuby
+          gnumake
+          plantuml
+          graphviz
+          jre
+          vale
+          epubcheck
+        ];
+
+        book = pkgs.stdenv.mkDerivation {
+          pname = "letterpress-book";
+          version = "0.1.0";
+          src = ./.;
+          nativeBuildInputs = runtimeInputs;
+          # asciidoctor-diagram caches into $HOME
+          buildPhase = ''
+            export HOME=$TMPDIR
+            make all
+          '';
+          installPhase = ''
+            mkdir -p $out
+            cp -r output/* $out/
+          '';
+        };
+      in
+      {
+        packages = {
+          default = book;
+          book = book;
+          gems = gems;
+        };
+
+        devShells.default = pkgs.mkShell {
+          packages = runtimeInputs ++ (with pkgs; [ bundix ]);
+          shellHook = ''
+            echo "letterpress dev shell"
+            echo "  make            build PDF + EPUB"
+            echo "  make output/book.pdf"
+            echo "  make output/book.epub"
+            echo "  make lint       run vale"
+            echo "  make epubcheck  validate EPUB"
+          '';
+        };
+
+        formatter = pkgs.nixpkgs-fmt;
+      });
+}