feat(lib): mksystem builder and nixpkgs overlays

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/overlays.nix

@@ -0,0 +1,44 @@
+# Overlays applied uniformly across every host built by mksystem.
+#
+# Pin select fast-moving packages to nixpkgs-unstable while keeping
+# everything else on the stable channel. This is the mitchellh pattern:
+# stable for stability, unstable for the handful of things that move
+# faster than we want to wait.
+#
+# To use, the flake.nix needs both inputs:
+#
+#   inputs.nixpkgs.url          = "github:nixos/nixpkgs/nixos-25.11";
+#   inputs.nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+#
+# Then:
+#
+#   overlays = import ./lib/overlays.nix { inherit inputs; };
+#   mkSystem = import ./lib/mksystem.nix { inherit nixpkgs overlays inputs; };
+
+{ inputs }:
+
+[
+  # Pinned-to-unstable packages.
+  #
+  # Add a package here when stable is too slow for your needs (claude-code
+  # ships weekly, gh fixes are frequent, direnv has churn). Remove when
+  # stable catches up. Keep the list small — every entry is a divergence
+  # from the rest of the stable closure.
+  (
+    final: prev:
+    let
+      unstable = import inputs.nixpkgs-unstable {
+        system = prev.stdenv.hostPlatform.system;
+        config.allowUnfree = true;
+      };
+    in
+    {
+      claude-code = unstable.claude-code;
+      pi-coding-agent = unstable.pi-coding-agent;
+      gh = unstable.gh;
+      direnv = unstable.direnv;
+      nix-direnv = unstable.nix-direnv;
+    }
+  )
+
+]