Add binary file streams, Nix release packages, and bounded release checks

[lukewilliamboswell]

Applications need bounded binary file reads and a reproducible way to consume the released platform with Nix. The previous 0.23.0 release attempt also stalled for almost six hours inside roc bump. This PR adds binary reads and lazy chunk streams, publishes Nix package outputs for a pinned release, and prevents API-comparison hangs from blocking warning-mode releases.

Fixes #117.

Binary files

• read_up_to!(max_bytes) permits short reads; an empty result means EOF for positive requests. Zero performs no I/O.
• read_exactly!(count) reports FileUnexpectedEOF on truncation. Failure may consume bytes and does not restore the cursor.
• position!() and seek!(Start(U64) | Current(I64) | End(I64)) report the logical buffered position; aliases share the cursor.
• chunks(max_bytes) rejects zero and returns a lazy builtin Stream(Try(List(U8), [FileErr(IOErr)])). Errors yield one error item followed by termination. Terminal continuations retain no reader, and retained byte lists survive later reads/seeks.

The Stream.custom dependency (roc-lang/roc#11691) is resolved by nightly-2026-09-26-d6267b4. All workflows and the Nix devshell pin that compiler, with matching merged roc-overlay metadata in flake.lock. The binary example is enabled with empty, short binary, multi-chunk, missing-argument, and missing-file cases.

Nix release packages

• nix build . / .#platform fetch and unpack the published release pinned in nix/release.json; .#bundle provides its original archive. These package outputs do not rebuild the checkout's hosts.
• The initial pin is 0.22.2, including its separately hashed HTTP dependency. The platform exposes the tested compiler and dependency replacement arguments for offline application builds.
• A consumer smoke check builds and runs inside Nix. CI runs it on Linux and macOS; nix/README.md provides a tested downstream flake example.
• Release follow-up PRs refresh the release URL, archive hash, and direct dependency pins from the published archive alongside the examples.

Release reliability

• Replace the unbounded bump action with a local 120-second check that saves diagnostics, warns on timeout/failure in warn mode, and fails in require mode.
• Keep warning mode because the compiler still rejects the public InternalHttp.TransportErr alias in 0.22.2. September 26 finishes this comparison with an extraction error; it no longer hangs in the reproduced case. This PR mitigates the release stall, not the upstream alias-extraction bug.
• Align release/docs setup-roc revisions with CI so nightly-tag is actually honored.

Validation

With nightly-2026-09-26-d6267b4 on x86_64 Linux:

• Full native format/check/test/build/run suite and all native example cases under Valgrind passed.
• All 58 Rust library tests passed; regenerated glue is unchanged and the glue check passed.
• All five glibc ownership fixtures passed under Valgrind, including binary/chunk aliasing, errors, retained chunks, and early termination: zero memory errors or definite/indirect leaks.
• All 12 release-tooling tests passed, including real hung subprocesses and published-archive metadata handling. The actual 0.22.2 bump comparison completes successfully through warning mode.
• nix flake check built and ran the consumer; the documented downstream flake also built and ran. All four supported systems passed flake evaluation.
• The metadata updater reproduced the checked-in release hashes. Actionlint and whitespace checks passed.

Supported-target and Nix CI are running for the updated head; they remain the merge gate.