[thebrandonlucas]

Replaces flake.nix/flake.lock with a Kaifile.roc on Kai 0.0.11 and a committed .kai/lock.json. The Kai shell matches the flake's:

• The Rust toolchain comes from rust-toolchain.toml through rust-overlay, plus llvm-tools-preview for the CRAP report (RustToolchainWith, new in 0.0.11).
• Python 3 and cargo-machete are added.
• On entry from the repository root, the shell runs cargo build --locked and puts target/debug on PATH. The flake's shellHook does the same; the Kaifile sets it with Raw("nix", "shell:default", ...).

.envrc, .gitignore, AGENTS.md (the friction-log repro.sh), docs/development.md and docs/quality.md are updated to match.

This PR is stacked on brandon/dev-2953-voltage-cli-add-environments-create.

Gaps against the flake

Gap	Effect
Kai 0.0.11 has no macOS release, and its flake builds only for Linux	The Kaifile declares Apple Silicon macOS and the shell works there, but a Mac can get Kai only by building it from source. docs/development.md sends macOS developers to rustup until a release exists. Intel macOS is not declared.
nixpkgs follows Kai's default nixos-unstable	The flake pinned nixos-26.05 to keep Intel macOS, which Kai does not support.

Verified

In a nixos/nix aarch64-linux container with Kai 0.0.11 (release tarball, checked against SHA256SUMS):

• kai check: Kaifile.roc is valid
• kai update created .kai/lock.json (nixpkgs 1d060086, rust-overlay 19e0e6c9)
• kai shell default -- ...: rustc 1.98.1, cargo-machete 0.9.2, Python 3.14.8, llvm-tools binaries in the sysroot, and voltage 0.2.0 from target/debug on PATH
• The full verification gate inside the shell: cargo fmt --check, clippy -D warnings, cargo machete, cargo test --locked (221 + 166 passed) and scripts/check-coverage.py all pass

On Apple Silicon macOS, with Kai 0.0.11 built from source as Kai's nightly CI builds it: kai check passes, kai update reports no input changed (declaring macOS leaves the lock as it is), and the shell and the full gate pass (rustc for aarch64-apple-darwin).

nix run/nix shell github:thebrandonlucas/kai/v0.0.11 both print 0.0.11 on aarch64-linux, as docs/development.md instructs.

These checks ran on this PR's tree: the one commit on top of brandon/dev-2953-voltage-cli-add-environments-create at 1748a5d. x86_64-linux was not run. This PR changes no Rust source, so the CRAP report was not rerun.

Note: in Docker Desktop containers, Roc fails to download the platform and std bundles (DownloadFailed). The cause is a last line of /etc/resolv.conf that holds only a space. Rewrite that file to its nameserver line, or put the bundles in ~/.cache/roc/packages/<hash>/ by hand.

Try it

On this branch, on Linux with Nix (flakes enabled):

nix shell github:thebrandonlucas/kai/v0.0.11
kai check
kai shell default -- rustc --version
kai shell default -- voltage --version

Expect: Kaifile.roc is valid; rustc 1.98.1; then the development voltage built from this checkout.