fix(build): provide protoc in Nix development shell

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

Author: pimlock

.audit/3388-public-policy-proto.tsv

@@ -44,3 +44,4 @@ ts	phase	decision	why	evidence	result
 2026-09-19T06:36:44Z	follow-up	Defer the contradictory internal any-binary merge semantics to issue #3476	Changing merge, advisor, CLI, and runtime authorization together is a separate behavioral decision; this PR only defines the new authored contract and documents its observed deny behavior	https://github.com/NVIDIA/OpenShell/issues/3476	The public policy stays fail-closed while the existing internal inconsistency has an explicit cross-component remediation issue
 2026-09-19T06:48:30Z	validation	Validate standalone incremental L7 fragments with the same portable annotations as complete PolicyDocument payloads	Incremental update messages reuse public L7 rules and binary selectors but do not contain a complete policy root, so root-only validation would let callers bypass required oneofs and string bounds	openshell-policy-schema fragment validators; openshell-policy lowering; server ingress; Go SDK converter tests	Direct API fragments now fail the same Protovalidate constraints before contextual lowering and merge validation
 2026-09-19T07:14:05Z	boundary-hardening	Validate complete provider and merged-policy documents before persistence, safely project JavaScript prototype-shaped parameter keys, and canonicalize legacy set-valued storage fields	Final independent review found that per-fragment validation missed aggregate limits, TypeScript object inheritance could erase untrusted map keys, and stricter public uniqueness rules could reject status-only rewrites of older equivalent records	provider mixed-batch and 1025-rule regressions; TypeScript __proto__/constructor regression; sandbox and provider durable rewrite regressions	All write paths now fail before partial persistence, SDK projection retains every own key without prototype mutation, and legacy duplicate ports or matcher alternatives preserve their enforcement meaning
+2026-09-19T07:26:31Z	build	Add protobuf to the Nix development shell	The pinned Rust Protovalidate runtime compiles its bundled constraint descriptor at build time; mise already provides protoc but the multi-architecture Rust CI shell did not	x86_64-linux Branch Checks lint failure; prost-protovalidate-types 0.6.0 build script; mise and flake tool inventories	Local and Nix-backed Rust builds now supply the same required descriptor compiler without changing runtime behavior

flake.nix

@@ -58,6 +58,8 @@
           git
           # Required to find packages.
           pkg-config
+          # Rust Protovalidate compiles its bundled constraint descriptors.
+          protobuf
           # Coverage.
           lcov
           kubernetes-helm