ci: gate on nix flake check (first CI for this repo)

pty-relay had no CI. Rather than a bespoke Node workflow — awkward while
`@compoundingtech/pty` is a `file:../pty` link dependency with no sibling
checkout on the runner — the flake is the gate: its inputs resolve the
sibling from the `pty` flake.

Modeled on compoundingtech/pty's .github/workflows/nix.yml, but running
`nix flake check` rather than `nix build` so checks.* actually gate.

Also adds checks.typecheck, running the repo's own `tsc --noEmit` against
the built tree (where the sibling resolves; it cannot pass against a bare
checkout).

The vitest suite is deliberately not gated: under the nix sandbox
test/daemon-runtime.test.ts hangs indefinitely at 0/14 and blocks two more
files, while the other 69/72 pass. The same suite is fully green against
the built tree outside the sandbox.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T1xLDkqUDCYUMMADdMqVgP
agent-session-id: 312caff5-3274-4d97-baa4-8ff06ab03fc5
agent-tool: Claude Code
agent-tool-version: 2.1.215
agent-model: claude-opus-4-8
agent-runtime-profile: /nix/store/acr8a3l2v366jgmwiq8xdrhgz1py0db5-coding-agent-runtime-profile/share/coding-agents/profile.json
agent-skills-manifest: /nix/store/sj1v5j91h8v8d1w9lca4040302lwrd6v-agent-skills-corpus/share/agent-skills/manifest.json
tooling-profile: dotfiles@unknown-dirty

Author: schickling-assistant

.github/workflows/nix.yml

@@ -0,0 +1,15 @@
+name: Nix
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/determinate-nix-action@v3
+      # `nix flake check` rather than `nix build`, so the checks.* gate too.
+      - run: nix flake check --print-build-logs

flake.nix

@@ -109,6 +109,25 @@
         };
 
         checks = {
+          # The repo's own `tsc --noEmit`. It only passes once
+          # @compoundingtech/pty resolves, which is exactly what the built
+          # output provides — so run it against that rather than the raw src.
+          typecheck = pkgs.runCommand "pty-relay-typecheck" { } ''
+            export HOME=$(mktemp -d)
+            cp -r ${pty-relay}/lib/pty-relay tree
+            chmod -R u+w tree
+            cd tree
+            ${nodejs}/bin/node node_modules/typescript/bin/tsc --noEmit
+            touch $out
+          '';
+
+          # NOTE: the vitest suite is deliberately NOT a check. It runs
+          # green against this same built tree outside the sandbox, but under
+          # the nix sandbox test/daemon-runtime.test.ts hangs indefinitely
+          # (0/14, blocking session-list-view and terminal); the other 69/72
+          # files pass. Gating `npm test` needs that file made sandbox-safe
+          # first, so CI covers typecheck + the CLI smoke checks only.
+
           help = pkgs.runCommand "pty-relay-help" { } ''
             export HOME=$(mktemp -d)
             ${pty-relay}/bin/pty-relay --help > /dev/null