feat(packages): Add marmel autonomous coding agent

Pin Na1w/marmel to commit fd551ae. Upstream publishes no tags or
releases, so the version uses the shape nix-update generates for a
tagless repository, keeping `nix-update --version=branch=main` usable.

The test suite runs green (325 lib tests plus all integration suites)
with two accommodations, both documented in the derivation:

- Export SSL_CERT_FILE from nixpkgs cacert. rustls refuses to construct
  a reqwest::Client without a system trust store, which failed 38 tests
  with "No CA certificates were loaded from the system".
- Serialise the test harness. The lib suite shares process-global worker
  registries and steer/abort buses, so manager-loop tests fail
  nondeterministically on parallel threads: one unchanged derivation
  produced 3 failures, then 1 failure, then 0 with --test-threads=1.
  No test is skipped or filtered.

Annotated example configs are installed to share/doc/marmel/examples/.
Role prompts are embedded via include_str!, so there is no runtime data
directory. Upstream README states MIT but ships no LICENSE file and no
Cargo.toml license field.

packages/marmel/package.nix

@@ -0,0 +1,76 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  cacert,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "marmel";
+  # Upstream publishes no git tags or releases, so this is pinned to a commit.
+  # The version shape matches what `nix-update --version=branch=main` generates
+  # for a tagless repository.
+  version = "unstable-2026-09-13";
+
+  src = fetchFromGitHub {
+    owner = "Na1w";
+    repo = "marmel";
+    rev = "fd551ae3198d427b0f0df3429f88764c49095b23";
+    hash = "sha256-nghvUF0EdqTGWT6GMG5oW1iK76r9vgvYeUj98hNraIo=";
+  };
+
+  cargoHash = "sha256-sUSsxcj4m4uJ28RKdJWKsb+MlVW6GkWjZdhKPFKlE/Y=";
+
+  nativeCheckInputs = [ cacert ];
+
+  # The test suite builds `reqwest::Client`s, and rustls rejects construction
+  # outright when no system trust store is found ("No CA certificates were
+  # loaded from the system"). The sandbox has no /etc/ssl, so point the tests
+  # at nixpkgs' bundle. Build-time only; the installed binary still uses the
+  # host's trust store at runtime.
+  preCheck = ''
+    export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
+  '';
+
+  # Serialise the test harness. The lib suite shares process-global worker
+  # registries and steer/abort buses (src/orchestrator/workers.rs,
+  # src/orchestrator/bus.rs, src/orchestrator/preemption.rs), so the
+  # manager-loop tests fail nondeterministically when the harness runs them on
+  # parallel threads: rebuilding one unchanged derivation yielded 3 failures,
+  # then 1 failure, then 0 with serial threads. All 325 tests still run — none
+  # are skipped or filtered. Drop this flag once upstream makes that state
+  # per-instance.
+  cargoTestFlags = [
+    "--"
+    "--test-threads=1"
+  ];
+
+  # Role prompts are embedded with `include_str!`, so the binary needs no
+  # runtime data files. The annotated example configs are the de-facto
+  # first-run documentation, since a backend URL and model are mandatory.
+  postInstall = ''
+    install -Dm644 marmel.toml.example $out/share/doc/${pname}/examples/marmel.toml.example
+    install -Dm644 marmel.toml.cloud $out/share/doc/${pname}/examples/marmel.toml.cloud
+  '';
+
+  passthru = {
+    category = "AI Coding Agents";
+    updateScript = [
+      "nix-update"
+      "--flake"
+      ".#marmel"
+      "--version=branch=main"
+    ];
+  };
+
+  meta = {
+    description = "Autonomous agentic coding assistant with Manager + specialist subagent orchestration over any OpenAI-compatible LLM backend";
+    homepage = "https://github.com/Na1w/marmel";
+    # Upstream README states MIT, but the repository ships no LICENSE file and
+    # Cargo.toml has no license field.
+    license = lib.licenses.mit;
+    sourceProvenance = with lib.sourceTypes; [ fromSource ];
+    mainProgram = "marmel";
+    platforms = lib.platforms.unix;
+  };
+}