feat(01-01): add flake.nix with writeShellApplication and all runtimeInputs

flake.nix

@@ -0,0 +1,39 @@
+{
+  description = "claudebox - sandboxed Claude Code";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    nix-index-database = {
+      url = "github:nix-community/nix-index-database";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs = { self, nixpkgs, nix-index-database, ... }:
+    let
+      system = "x86_64-linux";
+      pkgs = nixpkgs.legacyPackages.${system};
+      comma-with-db = nix-index-database.packages.${system}.comma-with-db;
+    in {
+      packages.${system} = {
+        claudebox = pkgs.writeShellApplication {
+          name = "claudebox";
+          runtimeInputs = [
+            pkgs.bubblewrap
+            pkgs.coreutils
+            pkgs.git
+            pkgs.curl
+            pkgs.jq
+            pkgs.ripgrep
+            pkgs.fd
+            pkgs.nix
+            comma-with-db
+            pkgs.bash
+            pkgs.nodejs
+          ];
+          text = builtins.readFile ./claudebox.sh;
+        };
+        default = self.packages.${system}.claudebox;
+      };
+    };
+}