docs: recommend nix-shell and declarative config for Nix/NixOS - #14592

A pull request's diff ran from the merge base of its head and its base
branch's current tip. Merged with a merge commit, a PR's head is in its
base branch, so that merge base was the head itself and the diff was
empty: on cli/cli#14592, GitHub says one file changed and ghtui showed
none. For a merged or closed PR the diff now runs from the base the PR
had (GitHub's baseRefOid, fetched by SHA when it isn't in the clone),
as GitHub's own does; an open PR's is still from its branch's tip.

Found in an audit and confirmed against GitHub. A git test merges a PR
with a merge commit and by squashing, and checks its files are its own
(and that the branch's tip leaves none after a merge commit); a state
test checks which base each kind of PR's diff asks for.

An ignored suite, cargo test -p ghtui-api --test contract -- --ignored
contract, turns each assumption the bugs fixed here rested on into a
dated fact, on data that doesn't change, through ghtui's own client
where it can:
- a comparison lists its newest commits only without per_page; with it,
  its first page is the oldest (ratatui v0.26.0...v0.26.1);
- branches by TAG_COMMIT_DATE come back by name, backwards, in GitHub's
  order by name (which puts wm-x before wm/x, so not bytes');
- a branch's associated PRs include other repositories';
- a long PR's commits(last: 1) is its headRefOid, and its checks are
  its head's (rust-lang/rust#160692, 229 commits);
- a GraphQL search has no page past 1,000, whatever it counts;
- a commit search's dates carry offsets;
- a PR merged with a merge commit has its head behind its base branch,
  and its baseRefOid gives its diff (cli/cli#14592);
- comments, reviews and commits come oldest first, releases and tags
  newest first, and a run's jobs a page at a time by per_page and page.

They only read, and pass without checking anything when there's no
token. A nightly workflow runs them, and the link crawl, with a token
from the CONTRACT_TOKEN secret, and skips cleanly without one;
graphql_json is public for them.