Aligns this fork to the canonical purescript-lua tooling.

What changed

• flake.nix now uses the purescript-overlay (thomashoneyman) instead of importing easy-purescript-nix directly. This pins purs 0.15.16 and spago 0.21.0 from the overlay's binary packages and adds the project's binary cache substituters via nixConfig.
• flake.lock regenerated for the new overlay inputs, with nixpkgs advanced to a current revision so the overlay evaluates cleanly.
• scripts/build now runs with set -euo pipefail so the build fails fast.
• Added .github/workflows/ci.yml: a Nix-based CI that builds via scripts/build, runs scripts/test when present, and runs Luacheck.

Why the overlay (not a plain flake update)

A plain nix flake update on the previous easy-purescript-nix flake makes plain nix develop fail on insecure nodejs (nodejs-20.20.2 is marked insecure), which would force --impure. The overlay flake evaluates and builds with plain nix develop, no --impure.

ngx global in Luacheck

This is the OpenResty nginx-bindings fork: the FFI in src/Lua/Ngx.lua and src/Lua/Ngx/Http/Status.lua legitimately references the global ngx. The CI Luacheck step therefore allows it with --globals ngx. The target src/ is placed after a -- separator (luacheck --quiet --std min --globals ngx -- src/) because --globals is a multi-value option and would otherwise consume src/ as a global name rather than a file path.

Verification

• nix develop -c true exits 0 with no --impure
• nix develop -c ./scripts/build exits 0
• no scripts/test in this fork (CI step is conditional, correctly skipped)
• nix develop -c luacheck --quiet --std min --globals ngx -- src/ exits 0 (0 warnings / 0 errors in 2 files)