flake.nix: Add simulation requirements to devShell

Adds the required tools listed in `simulation/README.md` to `flake.nix`.

flake.lock

@@ -126,11 +126,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1771371298,
-        "narHash": "sha256-AudCpsjP7MfL1mAusLjyyiOz+SF+JujxWzoSAhjk+Og=",
+        "lastModified": 1777560654,
+        "narHash": "sha256-ag+TnfQmMTdkU4lQPS6nZzpqHsWAlsQsLCv/1iA6GWg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bf117123cd658283c5b5c587e59091168323ad61",
+        "rev": "5a9c58fc6ac2ec48bf9cf4c07de27f912b1ed1cc",
         "type": "github"
       },
       "original": {

flake.nix

@@ -366,12 +366,25 @@
           just
           ripgrep
           sqlite
+
+          # /simulation
+          cue
+          kubectl
+          talosctl
+          timoni
+          qemu
+          OVMF.fd
         ];
 
         env = {
           RUST_BACKTRACE = "full";
           RUST_SRC_PATH = "${rustupDevShell.toolchain}/lib/rustlib/src/rust/library";
         };
+
+        # NixOS: OVMF firmware lives in the Nix store, not /usr/share/OVMF.
+        # talosctl has hardcoded search paths, so we expose the store path for
+        # the simulation justfile to symlink into a location talosctl can find.
+        env.OVMF_FD_PATH = "${pkgs.OVMF.fd}/FV";
       };
     });
 }