build/nix: devShell is missing required repo tools and drifts from the pinned Rust/Bazel toolchain

What issue are you seeing?

nix develop did not give me a working dev shell for normal repo workflows.

From a fresh checkout, the upstream flake.nix shell was missing tools that the repo's own workflows and just commands expect, including:

• just
• uv
• dotslash
• cargo-nextest
• bazel

I also ran into toolchain drift relative to repo-pinned versions:

• Rust is pinned by codex-rs/rust-toolchain.toml (1.95.0)
• Bazel is pinned by .bazelversion (9.0.0)

After adding Bazel to the shell locally, using a plain Nix Bazel package still did not satisfy the repo's exact .bazelversion requirement.

What steps can reproduce the bug?

Clone the repository.

1. Enter the repo root.
2. Run nix develop.
3. Try common repo commands such as:

• just help
• just fmt-check
• just test -p codex-tui
• bazel --version

1. Observe that the upstream dev shell is missing required tools and does not fully match the repo's pinned toolchain expectations.

What is the expected behavior?

After nix develop, the dev shell should be able to run common repo workflows without extra manual shell edits or host-installed tools.

At minimum, I would expect the shell to support:

• just help
• just fmt-check
• just test -p codex-tui
• bazel --version with a bazel on PATH that satisfies .bazelversion
• Rust matching codex-rs/rust-toolchain.toml

Additional information

I searched for existing reports and found related issues, but I did not find one that seemed to cover the broader devShell drift as a whole:

• #13263 build/nix: Missing libcap dependency
• #17639 build/nix: Missing voice dependencies such as libwebrtc
• #25523 Source-build docs omit uv required by just fmt

I also tried a local shell shape that got much further:

• added just
• added uv
• added dotslash
• added cargo-nextest
• source Rust from codex-rs/rust-toolchain.toml
• provided bazel via a small wrapper around bazelisk

That Bazelisk approach correctly resolved the repo's .bazelversion and returned bazel 9.0.0 locally.

One caveat: Bazelisk downloads the pinned Bazel binary on first use, so I understand that this is more of a dev-shell usability fix than a pure Nix build solution.

After those shell fixes, just test -p codex-tui got past the missing-tool/toolchain failures and ran the crate tests. The remaining failures were snapshot-style test failures rather than shell setup failures.

If a Bazelisk-based bazel wrapper is not acceptable here, is there a preferred Nix-native way the project would want flake.nix to satisfy the exact .bazelversion pin?

My Platform:
Linux 6.18.33.2-microsoft-standard-WSL2 x86_64 x86_64