feat(build): add a macOS cross-architecture dev shell

[kriswill]

What does this PR do?

Adds a cross flake dev shell so macOS users can build the other arch locally: nix develop .#cross then scripts/build.sh --arch x86_64 (on Apple Silicon) produces a working x86_64 binary — and vice versa on Intel.

The native clang already cross-emits object code via -arch (set up by the build fix in #723 — scripts/env.sh exports ARCHFLAGS). The only thing missing for a cross link is the target-arch dependency libraries, because the dev shell's zlib/libgit2 are host-arch only. This shell puts the target-arch zlib (a hard -lz dependency) and libgit2 (optional, via pkg-config) on the link path; they're fetched as prebuilt substitutes, so building needs no Rosetta — only running an x86_64 binary on Apple Silicon does.

Scope is deliberately minimal: flake.nix only, an added crossDevShells helper plus one merged attribute. The existing default shell is untouched, and there are no flake.lock / .envrc changes.

Validation (host aarch64-darwin, targeting x86_64)

$ nix develop .#cross
[cross] target x86_64-darwin — build with: scripts/build.sh --arch x86_64
$ scripts/build.sh --arch x86_64
=== Build complete: build/c/codebase-memory-mcp ===
$ file build/c/codebase-memory-mcp
build/c/codebase-memory-mcp: Mach-O 64-bit x86_64 executable
$ otool -L build/c/codebase-memory-mcp | grep -Ei 'git2|libz'
  /nix/store/…-libgit2-1.9.4-lib/lib/libgit2.1.9.dylib   # x86_64
  /nix/store/…-zlib-1.3.2/lib/libz.dylib                 # x86_64

The binary links the x86_64 slices of libgit2 + zlib (no stale host-arch references). Constraint, as flagged on #705: a working x86_64 build needs x86_64 zlib (mandatory) + libgit2, which this shell provides as substitutes.

Depends on #723 (ARCHFLAGS + the compiler capability probe) — the cross shell is only useful once that lands, so please merge this after #723. Refs #705.

Checklist

• Every commit is signed off (git commit -s) — required, CI rejects
  unsigned commits (DCO, see CONTRIBUTING.md)
• Tests pass locally (make -f Makefile.cbm test)
• Lint passes (make -f Makefile.cbm lint-ci)
• New behavior is covered by a test (reproduce-first for bug fixes)

On the checklist: this is a flake.nix-only change — it adds an opt-in dev shell and does not touch the C sources, scripts, or Makefile, so make test / lint-ci are unaffected (no C or lint surface). Validation is the flake evaluation (both default and cross shells evaluate on aarch64-darwin; default on Linux) plus the cross-build transcript above. There is no CI runner for macOS cross-arch today; happy to discuss adding one.

[DeusData]

Huge thanks for opening this PR and for the work you put into it.

This touches the Nix flake / build environment, so it will need the usual careful build-infra review before merge. The maintainer shop is currently full, so this may sit for a bit before it gets a proper review, but we will come back with real feedback as soon as possible.

[DeusData]

Thanks. Because this changes the Nix build shell and target-arch dependency resolution, maintainers need to verify it after #723. Could you add the exact nix develop .#cross smoke command/output for the host/target arch cases you tested?

[kriswill]

@DeusData I added this cross-architecture bit to test #723 under my MacOS+Nix config, to prove that the compiler architecture probe works. I personally am not really interested in compiling x86_64-darwin binaries, since it's not practical for any developer to be using that architecture (very old Apple machines), unless they are doing so on an old Mac-mini in a homelab or something....

The purpose of the probe change is ONLY to enable an engineer to follow the instructions in CONTRIBUTING.md about running the build toolchain when using a nix devshell on Apple Silicon, which currently does NOT work see #705