feat(lib): Add nix-shell helper

This allows running the specified script in a nix-shell invocation

default.nix

@@ -10,7 +10,13 @@
 let
   inherit (pkgs) mkShell;
 
-  inherit (pkgs.lib) evalModules getExe recursiveUpdate;
+  inherit (pkgs.lib)
+    escapeShellArgs
+    evalModules
+    getExe
+    optionals
+    recursiveUpdate
+    ;
 
   inherit (pkgs.lib.fileset) gitTracked toSource;
 
@@ -146,6 +152,24 @@ in
   lib = rec {
     expr = repr: "\${{ ${repr} }}";
     secret = name: expr "secrets.${name}";
+    nix-shell =
+      {
+        script,
+        extraArgs ? [ ],
+        shell ? null,
+      }:
+      escapeShellArgs (
+        [ "nix-shell" ]
+        ++ extraArgs
+        ++ (optionals (shell != null) [
+          "-A"
+          shell
+        ])
+        ++ [
+          "--run"
+          script
+        ]
+      );
   };
 
   steps =