fix(goose-cli): resolve bindgen and test failures in Nix sandbox

- Added stdenv and BINDGEN_EXTRA_CLANG_ARGS to fix libclang header
  resolution for llama-cpp-sys-2 bindgen (stdio.h not found)
- Added cmake to nativeBuildInputs (required by llama-cpp-sys-2 build)
- Added cacert and SSL_CERT_FILE to fix reqwest CA certificate errors
  in tests (No CA certificates were loaded from the system)
- All 191 tests now pass in the sandbox

packages/goose-cli/package.nix

@@ -1,8 +1,11 @@
 {
   lib,
+  stdenv,
   fetchFromGitHub,
   rustPlatform,
   pkg-config,
+  cmake,
+  cacert,
   openssl,
   libxcb,
   dbus,
@@ -26,6 +29,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     pkg-config
+    cmake
     llvmPackages.libclang
   ];
 
@@ -39,8 +43,12 @@ rustPlatform.buildRustPackage rec {
   # To avoid this we pre-download the file and export it via RUSTY_V8_ARCHIVE
   env.RUSTY_V8_ARCHIVE = librusty_v8;
 
-  # bindgen (used by llama-cpp-sys-2) needs libclang
+  # bindgen (used by llama-cpp-sys-2) needs libclang and C headers
   env.LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+  env.BINDGEN_EXTRA_CLANG_ARGS = "-isystem ${lib.getDev stdenv.cc.libc}/include";
+
+  # reqwest needs CA certificates in the sandbox
+  env.SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
   # Build only the CLI package
   cargoBuildFlags = [