Package Penpot 2.18.3 for Nix with NixOS module; afk devShell

Vendored from debling/nix-penpot (MIT). Fixes on top:
- pnpm fetchers: drop --config.fetch-* flags (UND_ERR_INVALID_ARG on pnpm 11.27)
  and pin real store hashes (frontend x3, exporter, mcp)
- deps-lock.json: add transitive funcool/beicon2 v2.0 so fake-git resolves
  potok2's pin during the shadow-cljs classpath build
- expose frontend pnpm stores via passthru for rehashing
- x86_64-linux only; devShell ships afk, jj, git

packages/imagemagick-policy.nix

@@ -0,0 +1,11 @@
+# Hardened ImageMagick policy shipped by the upstream images (resource caps
+# and PS/EPS/PDF/XPS coders disabled); nixpkgs' default policy is
+# unrestricted and the backend/exporter process user-controlled content.
+{
+  runCommand,
+  penpot,
+}:
+runCommand "penpot-imagemagick-policy" { } ''
+  install -Dm644 "${penpot}/docker/images/files/imagemagick-policy.xml" \
+    "$out/etc/ImageMagick-7/policy.xml"
+''