fips

Add Nix flake for building fips on NixOS.

Merge maint into master (libclang build-prereq doc + transport mutex-poison recovery)

transport: recover poisoned mutex guards instead of panicking on lock

docs: document libclang-dev as a mandatory Linux build prerequisite

docs: record the file-descriptor tuning how-to in the changelog