Full rewrite of devshell

migrates pre-commit to cachix's pre-commit-hooks

adds a ton of new hooks:
- check-added-large-files
- check-case-conflicts
- check-json
- check-merge-conflicts
- detect-private-keys
- fmt-check
- nil
- no-commit-to-branch
- statix (disabled for now)

migrates devshell to new devshells, set up modularly to have separate
functionality for sops, pre-commit-hooks, and our custom packages

Signed-off-by: ahuston-0 <aliceghuston@gmail.com>

checks.nix

@@ -0,0 +1,39 @@
+{
+  inputs,
+  forEachSystem,
+  formatter,
+  ...
+}:
+forEachSystem (system: {
+  pre-commit-check = inputs.pre-commit-hooks.lib.${system}.run {
+    src = ./.;
+    hooks = {
+      # nix checks
+      # Example custom hook for nix formatting:
+      fmt-check = {
+        enable = true;
+
+        # The command to execute (mandatory):
+        entry = "${formatter.${system}}/bin/nixfmt --check";
+
+        # The pattern of files to run on (default: "" (all))
+        # see also https://pre-commit.com/#hooks-files
+        files = "\\.nix$";
+      };
+      nil.enable = true;
+      statix.enable = false;
+
+      # json hooks
+      check-json.enable = true;
+
+      # git hooks
+      check-merge-conflicts.enable = true;
+      no-commit-to-branch.enable = true;
+
+      # misc hooks
+      check-added-large-files.enable = true;
+      check-case-conflicts.enable = true;
+      detect-private-keys.enable = true;
+    };
+  };
+})