fix: auto-detect native deps, skip nix-shell in Docker

Check for pkg-config at make-time; if present (Docker, existing
nix-shell) run commands directly, otherwise wrap with nix-shell.

Makefile

@@ -3,8 +3,16 @@
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
 LDFLAGS := -X main.Version=$(VERSION)
 
-# nix-shell wrapper for targets that need CGO dependencies (libvips, pkg-config)
-NIX_SHELL := nix-shell -p pkg-config vips libheif golangci-lint git --run
+# Use nix-shell to provide CGO dependencies unless they are already available
+# (e.g. inside a Docker build or an existing nix-shell).
+HAS_PKGCONFIG := $(shell command -v pkg-config 2>/dev/null)
+ifdef HAS_PKGCONFIG
+  NIX_RUN_PREFIX =
+  NIX_RUN_SUFFIX =
+else
+  NIX_RUN_PREFIX = nix-shell -p pkg-config vips libheif golangci-lint git --run '
+  NIX_RUN_SUFFIX = '
+endif
 
 # Default target: run all checks
 check: fmt-check lint test
@@ -22,17 +30,17 @@ fmt:
 # Run linter
 lint:
 	@echo "Running linter..."
-	$(NIX_SHELL) "golangci-lint run"
+	$(NIX_RUN_PREFIX)golangci-lint run$(NIX_RUN_SUFFIX)
 
 # Run tests (30-second timeout)
 test:
 	@echo "Running tests..."
-	$(NIX_SHELL) "CGO_ENABLED=1 go test -timeout 30s -v ./..."
+	$(NIX_RUN_PREFIX)CGO_ENABLED=1 go test -timeout 30s -v ./...$(NIX_RUN_SUFFIX)
 
 # Build the binary
 build:
 	@echo "Building pixad..."
-	$(NIX_SHELL) "CGO_ENABLED=1 go build -ldflags '$(LDFLAGS)' -o ./bin/pixad ./cmd/pixad"
+	$(NIX_RUN_PREFIX)CGO_ENABLED=1 go build -ldflags "$(LDFLAGS)" -o ./bin/pixad ./cmd/pixad$(NIX_RUN_SUFFIX)
 
 # Clean build artifacts
 clean: