Add Nix flake and nixpkgs overlay for the CLI

[Matt (matt-evervault)]

What

Adds a Nix package definition for the Evervault CLI:

• nix/evervault-cli.nix — rustPlatform.buildRustPackage for ev, pinned to the v4.5.1 tag on GitHub
• nix/overlay.nix — nixpkgs overlay exposing it as pkgs.evervault-cli
• flake.nix / flake.lock — exposes packages.<system>.evervault-cli (and default) plus overlays.default
• README install section covering both routes

Why

So the CLI can be installed with Nix instead of curl | sh. Two ways to use it:

nix run github:evervault/evervault-cli -- --help

or, after dropping the overlay in ~/.config/nixpkgs/overlays/ (see README):

nix-shell -p evervault-cli

This isn't in nixpkgs upstream, so the overlay has to be added per-machine — that's deliberate, no packaging-submission work implied.

Notes

• The package pins a released tag rather than building the checkout, so nix/evervault-cli.nix needs its version + srcHash bumped on each release. Deliberate: it keeps nix run giving you a real release, and avoids the flake breaking whenever main is mid-flight.
• postPatch mirrors crates/ev-cli/scripts/insert-cli-version.sh so ev --version reports 4.5.1, not 1.0.0-dev.
• OPENSSL_NO_VENDOR=1 — ev-cli turns on openssl's vendored feature; this builds against nixpkgs' openssl instead, which is the nixpkgs convention.
• doCheck = false — the test suite talks to the Evervault API.
• No devShell in the flake; this PR is only about packaging the binary.

Verified locally (aarch64-darwin)

• nix build .#evervault-cli → ./result/bin/ev --version prints Evervault CLI 4.5.1
• Overlay applied over the local <nixpkgs> builds and runs the same binary
• nix flake show evaluates cleanly for all four darwin/linux systems

Not tested on Linux.

🤖 Generated with Claude Code

[ev-vaultkeeper]

Vaultkeeper Commands

Mention @ev-vaultkeeper <command> in a PR review thread:

• review — Review this PR and leave a review.
• address-comments — Push commits that address the review feedback on this PR.
• fix-ci — Investigate the failing CI on this PR and push a fix.

You can also request evervault-dependencies as a reviewer to trigger a review.