fix(nix): drop path:./cli input that broke nix build in CI
A relative `path:./cli` flake input can't be locked inside a git repo, so
`nix build` failed with "lock file contains unlocked input". Extract the
crane build into a shared cli/package.nix imported by both flakes:
- cli/flake.nix builds it with src = ./.
- the root flake builds it with src = ./cli (default package)
Neither uses a path input now; both locks contain only GitHub inputs.