feat: introduce nix-shell

flakes are not stable yet, community is divided but maintaining both
flake and a set of dependencies in our scripts is hard.
So provide a nix-shell that fetches the nixpkgs recorded in the
flake.lock to keep a single source of truth

shell.nix

@@ -0,0 +1,15 @@
+let
+  nixpkgs = (
+    import (
+      let
+        lock = builtins.fromJSON (builtins.readFile ./flake.lock);
+        n = lock.nodes.nixpkgs.locked;
+      in
+      fetchTarball {
+        url = "https://github.com/${n.owner}/${n.repo}/archive/${n.rev}.tar.gz";
+        sha256 = n.narHash;
+      }
+    ) { }
+  );
+in
+nixpkgs.callPackage ./home-manager { }