Add reproducible dev environment

- flake.nix: rebrand description, add Go 1.25, gopls, gotools,
  staticcheck, golangci-lint, gnumake to all dev shells. Add a
  plain `dev` shell (`nix develop .#dev`) that does not wrap the
  shell in the bubblewrap sandbox so contributors can use a
  standard Go toolchain.
- Dockerfile.dev: golang:1.22-bookworm with make, git, gopls and
  staticcheck, /workspace as default cwd. CGO disabled.
- README: document both nix and Docker dev paths.

flake.lock is committed for reproducibility.

Closes #6.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Dockerfile.dev

@@ -0,0 +1,18 @@
+FROM golang:1.22-bookworm
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        make \
+        git \
+        ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN go install honnef.co/go/tools/cmd/staticcheck@latest \
+    && go install golang.org/x/tools/gopls@latest
+
+WORKDIR /workspace
+
+ENV CGO_ENABLED=0 \
+    GOFLAGS=-mod=mod
+
+CMD ["bash"]

README.md

@@ -45,10 +45,18 @@ See `./librenotes help` for the full command list.
 ## Development setup
 
 A Nix flake provides a reproducible development environment with Go,
-build tools, and the project CLIs:
+build tools, and the project CLIs. Use the plain `dev` shell for a
+non-sandboxed Go toolchain:
 
 ```sh
-nix develop
+nix develop .#dev
+```
+
+Alternatively, build a Docker-based dev environment:
+
+```sh
+docker build -f Dockerfile.dev -t librenotes-dev .
+docker run --rm -it -v "$PWD:/workspace" librenotes-dev
 ```
 
 The repository layout follows the standard Go project structure:

flake.lock

@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1771848320,
+        "narHash": "sha256-0MAd+0mun3K/Ns8JATeHT1sX28faLII5hVLq0L3BdZU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "2fc6539b481e1d2569f25f8799236694180c0993",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -1,5 +1,5 @@
 {
-  description = "Notesium notes environment";
+  description = "librenotes development environment";
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
@@ -12,8 +12,15 @@
         pkgs = import nixpkgs { inherit system; config.allowUnfree = true; };
 
         packages = with pkgs; [
-          # claude-code
+          # Go toolchain
-          gh
+          go_1_25
+          gopls
+          gotools
+          go-tools
+          golangci-lint
+          gnumake
+          # Project CLIs
+          tea
           bubblewrap
         ];
 
@@ -43,6 +50,8 @@
 
             --ro-bind "$HOME/.gitconfig" "$HOME/.gitconfig"
             --ro-bind "$HOME/.ssh" "$HOME/.ssh"
+            --setenv GIT_SSH_COMMAND "ssh -F ~/.ssh/config"
+            --ro-bind "$HOME/.config/tea" "$HOME/.config/tea"
             --ro-bind "$HOME/.config/gh" "$HOME/.config/gh"
             --ro-bind "$HOME/.local/bin" "$HOME/.local/bin"
 
@@ -74,9 +83,9 @@
               export SHELL_FUNCTIONS="${shellFunctionsScript}"
 
               if [ ! -t 0 ] || [ -n "$NIX_DEVELOP_COMMAND" ]; then
-                echo "=== Notesium (sandbox: enter-sandbox) ==="
+                echo "=== librenotes (sandbox: enter-sandbox) ==="
               else
-                echo "=== Notesium Sandbox ==="
+                echo "=== librenotes Sandbox ==="
                 echo "WRITE: $PWD, ~/.claude"
                 exec enter-sandbox ${pkgs.bash}/bin/bash --rcfile <(cat << 'SANDBOX_BASHRC'
               source "$SHELL_FUNCTIONS"
@@ -91,7 +100,19 @@ SANDBOX_BASHRC
             buildInputs = packages;
             shellHook = ''
               ${shellFunctions}
-              echo "=== Notesium (YOLO - no sandbox) ==="
+              echo "=== librenotes (YOLO - no sandbox) ==="
+            '';
+          };
+
+          # Plain Go dev shell, no sandbox wrapping. For contributors who
+          # just want `nix develop .#dev` to get a working toolchain.
+          dev = pkgs.mkShell {
+            buildInputs = with pkgs; [
+              go_1_25 gopls gotools go-tools golangci-lint gnumake
+            ];
+            shellHook = ''
+              echo "=== librenotes dev ==="
+              echo "go: $(go version)"
             '';
           };
         };