letta-code: Fix sharp module loading on all platforms

[Copilot]

The package failed at runtime with "Could not load the sharp module" because platform-specific native binaries weren't being installed. The simple fetchzip approach didn't handle npm dependencies.

Changes:

• Convert to buildNpmPackage to properly install npm dependencies including sharp's platform-specific optionalDependencies
• Fetch package-lock.json from GitHub main branch during build (npm tarball excludes it, but repo includes it)
• Set NPM_CONFIG_IGNORE_SCRIPTS=true and npmRebuildFlags to prevent postinstall scripts from attempting network access
• Inline all hashes in package.nix for standard nix-update compatibility

Technical Details:
The npm tarball contains pre-built letta.js but no lockfile. GitHub source has the lockfile but requires bun to build. Solution: fetch lockfile from GitHub and apply it to the npm tarball.

packageLock = fetchurl {
  url = "https://raw.githubusercontent.com/letta-ai/letta-code/main/package-lock.json";
  hash = "sha256-...";
};

srcWithLock = runCommand "letta-code-src-with-lock" { } ''
  tar -xzf ${src} -C $out --strip-components=1
  cp ${packageLock} $out/package-lock.json
'';

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Mic92]

@copilot the github repo has a lock file why do we provide our own?

[Copilot]

@copilot the github repo has a lock file why do we provide our own?

We ARE using the GitHub repo's lockfile - we fetch it from the main branch at line 22.

The approach is: npm tarball (has pre-built letta.js) + GitHub lockfile (has package-lock.json).

We can't use the GitHub source directly because it requires bun to build (see package.json scripts.build: "node scripts/postinstall-patches.js && bun run build.js"), and the npm tarball doesn't include the lockfile. So we fetch the lockfile separately from GitHub and apply it to the npm tarball.