The devShell carries the toolchain plus the X11, Wayland, Vulkan,
fontconfig and freetype libraries winit and wgpu dlopen at run time,
and the trunk/wasm-bindgen pair the web build needs. LD_LIBRARY_PATH
is set there too, since a dev binary runs straight out of ./target and
never gets the wrapper the package build applies.
The four git dependencies each need an entry in cargoLock.outputHashes.
They are lib.fakeHash for now; the first `nix build` prints the real
values, and they have to be refreshed whenever a rev in Cargo.toml
moves.
