flake: fetch inputs via git+https instead of github: shorthand

The `github:` flake-ref shorthand fetches source as tarballs from
api.github.com / codeload.github.com. In the Claude Code web sandbox these
endpoints are served by a GitHub proxy that scopes access to the session's
own repositories and returns HTTP 403 for every other repo, so `nix develop`
fails while resolving third-party inputs (flake-parts, nixpkgs, agda.nix and
its transitive Agda libraries).

Plain git-over-https, by contrast, is served by that proxy for any public
repo. Declaring the inputs as `git+https://github.com/...` and pinning the
lock nodes to the `git` fetcher routes resolution through the working path.
The narHash for each rev is identical between the two fetchers, so the pins
are unchanged and this is a no-op on unrestricted networks.

nixpkgs additionally sets `shallow=1`: when the pinned source cannot be
substituted by narHash from a binary cache, a shallow fetch of the locked
rev avoids cloning nixpkgs' full history.

Verified with `nix develop --command agda --version` (Agda 2.8.0).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B1ArmS9aNbCxuwhC7zYLBx

Author: williamdemeo

flake.lock

@@ -2,15 +2,21 @@
 {
   description = "Formal Ledger Specifications";
 
+  # NOTE: inputs use git+https://... instead of the github: shorthand. The
+  # github: fetcher pulls tarballs from api.github.com / codeload.github.com,
+  # which the Claude Code web sandbox proxy 403s for third-party repos; plain
+  # git-over-https works there for any public repo. narHashes are identical
+  # between the two fetchers, so the pins are unchanged. nixpkgs adds
+  # `shallow=1` so a binary-cache miss fetches only the locked rev.
   inputs = {
-    nixpkgs.url = "github:NixOs/nixpkgs";
+    nixpkgs.url = "git+https://github.com/NixOs/nixpkgs?shallow=1";
 
     flake-parts = {
-      url = "github:hercules-ci/flake-parts";
+      url = "git+https://github.com/hercules-ci/flake-parts";
     };
 
     agda-nix = {
-      url = "github:input-output-hk/agda.nix";
+      url = "git+https://github.com/input-output-hk/agda.nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };