fix(nix): use pnpm.fetchDeps derivation and add flake lock

docs/plans/state.json

@@ -60,7 +60,7 @@
       "status": "completed",
       "date": "2026-02-16",
       "updated": "2026-02-16",
-      "summary": "Added a Nix flake/package that builds dist/ (including dist/gateway/ui adjacency) and an optional NixOS module (services.flynn) for systemd deployment.",
+      "summary": "Added a Nix flake/package that builds dist/ (including dist/gateway/ui adjacency) and an optional NixOS module (services.flynn) for systemd deployment. Follow-up fix switched package build from unavailable buildPnpmPackage to pnpm.fetchDeps + stdenv.mkDerivation and added flake.lock.",
       "files_created": [
         "flake.nix",
         "nix/package.nix",
@@ -68,9 +68,11 @@
         "docs/deployment/NIX.md"
       ],
       "files_modified": [
-        "docs/deployment/PRODUCTION.md"
+        "docs/deployment/PRODUCTION.md",
+        "flake.lock",
+        "nix/package.nix"
       ],
-      "test_status": "Not run (Nix build requires pnpmDepsHash update); pnpm test suite unaffected"
+      "test_status": "nix build now evaluates; still requires real pnpm.fetchDeps hash from first build"
     },
 
     "deployment-targets-paas": {