chore(nix): pin code-maat 1.0.4 and a JRE in the dev and ci shells (improvise-1xfb.5.1)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze

flake.nix

@@ -83,8 +83,21 @@
         pkgs.nodejs_24
         pkgs.python3
         pkgs.jq
+
+        # scripts/repo-stats runs code-maat for coupling, age, abs-churn and
+        # soc (improvise-1xfb.5.1); the jar is pinned here, not downloaded.
+        pkgs.jre_headless
+        codeMaat
       ];
 
+      codeMaatJar = pkgs.fetchurl {
+        url = "https://github.com/adamtornhill/code-maat/releases/download/v1.0.4/code-maat-1.0.4-standalone.jar";
+        hash = "sha256-QoeuIDSQGERFD3aVR7xEl6DaGm0cf6b63IWHBeZ0O18=";
+      };
+      codeMaat = pkgs.writeShellScriptBin "code-maat" ''
+        exec ${pkgs.jre_headless}/bin/java -jar ${codeMaatJar} "$@"
+      '';
+
       # Playwright's downloaded browsers are generic-Linux builds that cannot
       # start on NixOS, so nixpkgs' build is used. harness/package.json pins
       # @playwright/test to this playwright-driver's version: they must match.