build: build the io-mon shim with a writable nimcache (read-only source)

The package build and dev shell consume io-mon as a Nix flake input (a
read-only store path), but io-mon's build_shim.sh wrote its nimcache to a
path relative to its own source tree, so `mkdir build`/the nim cache write
failed with "Permission denied" / "Read-only file system" — breaking
`nix build .#default`, the `repro` bootstrap, and `just test`.

Pass IO_MON_SHIM_NIMCACHE_DIR (new, absolute, under reprobuild's writable
build/) alongside the existing IO_MON_SHIM_OUT_DIR so the shim writes
nothing into io-mon's source; bump io-mon-src to the release carrying that
knob. Verified: `nix build .#default` now builds the shim (SuccessX) and
proceeds to compile with no build-dir error.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: zah

flake.lock

@@ -44,7 +44,12 @@ if [ ! -x "${io_mon_src}/scripts/build_shim.sh" ]; then
   echo "missing io-mon shim builder at ${io_mon_src}/scripts/build_shim.sh; set IO_MON_SRC" >&2
   exit 2
 fi
+# Point BOTH the shim's output dir and its nimcache at reprobuild's own
+# (writable) build tree. io-mon's source is read-only when it comes from a Nix
+# flake input / store path (the package build + dev shell), so the shim must not
+# write its nimcache into its own source — pass an absolute writable dir.
 IO_MON_SHIM_OUT_DIR="$(pwd)/build/lib" \
+IO_MON_SHIM_NIMCACHE_DIR="$(pwd)/build/nimcache/io-mon-shim" \
 IO_MON_BUILD_MODE="${REPROBUILD_BUILD_MODE:-debug}" \
   bash "${io_mon_src}/scripts/build_shim.sh"