docs: document Nix lockfile sync for dependency updates

Author: elucid

CONTRIBUTING.md

@@ -87,6 +87,24 @@ bun run check:prebuilt-pack
 bun run publish:prebuilt:npm -- --dry-run
 ```
 
+## Updating dependencies
+
+After changing JavaScript or Bun dependencies, regenerate the Nix dependency lockfile so CI stays green:
+
+```bash
+bun install
+bun run nix:update-lock
+git add bun.lock nix/bun.lock.nix package.json
+```
+
+The `nix:update-lock` script requires a one-time [Nix install](https://nixos.org/download/):
+
+```bash
+curl -L https://nixos.org/nix/install | sh
+```
+
+If you don't have Nix installed, CI will catch the drift and a maintainer can push the regenerated lockfile as a follow-up commit.
+
 ## Validation expectations
 
 - Rendering changes: run `bun run typecheck`, `bun test`, `bun run test:tty-smoke`, and do one real TTY smoke run on an actual diff.