Installation failure on NixOS

```
dune build -p bin_prot -j 7
File "xen/dune", lines 1-6, characters 0-111:
1 | (rule
2 | (targets cflags.sexp)
3 | (deps
4 | (:first_dep cflags.sh))
5 | (action
6 | (bash "./%{first_dep} > %{targets}")))
(cd _build/default/xen && /nix/store/p5441mp6wwpdh65qamaixvd092cwr45h-bash-interactive-5.2p26/bin/bash -e -u -o pipefail -c './cflags.sh > cflags.sexp')
/nix/store/p5441mp6wwpdh65qamaixvd092cwr45h-bash-interactive-5.2p26/bin/bash: line 1: ./cflags.sh: cannot execute: required file not found
```

A fix is to change the shebang from ` #!/bin/bash` to the portable `#!/usr/bin/env bash` in `cflags.sh` as in https://github.com/janestreet/bin_prot/issues/26. It looks like https://github.com/janestreet/bin_prot/pull/29 would also fix this.

Start with xen/cflags.sh and reproduce the reported `dune build -p bin_prot -j 7` failure on NixOS. Check the script invocation and verify that the build completes successfully with a portable shell entry point; the issue references bin_prot#26 and pull request #29 for context.

Written by the indexing model from the issue text.