Establish repository foundation and shared work environment

modules/capabilities/yookr-dev/_packages.nix

@@ -0,0 +1,30 @@
+{ pkgs }:
+{
+  gardenctl = pkgs.stdenvNoCC.mkDerivation {
+    pname = "gardenctl";
+    version = "2.14.0";
+    src = pkgs.fetchurl {
+      url = "https://github.com/gardener/gardenctl-v2/releases/download/v2.14.0/gardenctl_v2_linux_amd64";
+      hash = "sha256-JCZ0eJLgYbd2ZMCCWFlhX4vOhHKZL40oR2a3EZ3i4Q8=";
+    };
+    dontUnpack = true;
+    installPhase = ''
+      install -Dm755 "$src" "$out/bin/gardenctl"
+      install -d "$out/share/zsh/site-functions"
+      "$out/bin/gardenctl" completion zsh > "$out/share/zsh/site-functions/_gardenctl"
+    '';
+  };
+  gardenlogin = pkgs.stdenvNoCC.mkDerivation {
+    pname = "gardenlogin";
+    version = "0.10.0";
+    src = pkgs.fetchurl {
+      url = "https://github.com/gardener/gardenlogin/releases/download/v0.10.0/gardenlogin_linux_amd64";
+      hash = "sha256-X4nHiZ29Mbnhxv/wlyD6PxX1KxzaX2R27N7Muu/gnH8=";
+    };
+    dontUnpack = true;
+    installPhase = ''
+      install -Dm755 "$src" "$out/bin/gardenlogin"
+      ln -s gardenlogin "$out/bin/kubectl-gardenlogin"
+    '';
+  };
+}

modules/capabilities/yookr-dev/environment.nix

@@ -0,0 +1,34 @@
+{
+  perSystem =
+    { pkgs, ... }:
+    let
+      tools = import ./_packages.nix { inherit pkgs; };
+    in
+    {
+      # Tooling only: no credential loading, mounts, or Python dependency installs.
+      devShells.workbench = pkgs.mkShell {
+        LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath [
+          pkgs.stdenv.cc.cc.lib
+          pkgs.zlib
+        ];
+        UV_PYTHON = "${pkgs.python314}/bin/python";
+        UV_PYTHON_DOWNLOADS = "never";
+        packages = [
+          tools.gardenctl
+          tools.gardenlogin
+        ]
+        ++ (with pkgs; [
+          k9s
+          kubectl
+          kubelogin-oidc
+          jq
+          just
+          python314
+          rclone
+          sops
+          util-linux
+          uv
+        ]);
+      };
+    };
+}