feat: add cachix binary cache for firefly-toolbox

Configure nixConfig in flake.nix to automatically use the
firefly-toolbox cachix cache for downstream consumers. Accept
flake config in .envrc for local dev. Document cache push command.

Author: sigma

.envrc

@@ -7,4 +7,4 @@ if [ ! -f .devenv-root ]; then
 fi
 
 watch_file .devenv-root
-use flake . --override-input devenv-root "file+file://$PWD/.devenv-root" --impure
+use flake . --override-input devenv-root "file+file://$PWD/.devenv-root" --impure --accept-flake-config

AGENTS.md

@@ -316,6 +316,20 @@ Once you've identified that a newer version exists:
 3. Update `_meta.default` to the new version.
 4. Test the build and verify the binary.
 
+## Binary Cache (Cachix)
+
+Toolbox packages are cached on [Cachix](https://app.cachix.org/cache/firefly-toolbox) (`firefly-toolbox`). The flake's `nixConfig` automatically configures downstream consumers to use this cache.
+
+### Pushing all packages to the cache
+
+```bash
+nix build --no-link --print-out-paths --impure --expr '
+  builtins.attrValues (builtins.getFlake (toString ./.)).packages.aarch64-darwin
+' | cachix push firefly-toolbox
+```
+
+Replace `aarch64-darwin` with the target system (e.g., `x86_64-linux`) as needed.
+
 ## Verification Checklist
 
 After making changes:

flake.nix

@@ -1,6 +1,11 @@
 {
   description = "Toolbox: self-contained package registry for turnkey";
 
+  nixConfig = {
+    extra-substituters = [ "https://firefly-toolbox.cachix.org" ];
+    extra-trusted-public-keys = [ "firefly-toolbox.cachix.org-1:4RgCoc0+CS7QhRarG109VmWlnlYi+rQ5JYrCsRP5aK8=" ];
+  };
+
   inputs = {
     nix-pins.url = "github:firefly-engineering/nix-pins";
     nixpkgs.follows = "nix-pins/nixpkgs";