fix(nix): upgrade Python 3.11 → 3.12 and add cross-platform eval check

[alt-glitch]

Summary

nix run github:NousResearch/hermes-agent -- setup fails on macOS with sphinx-9.1.0 not supported for interpreter python3.11. The nixpkgs pin ships sphinx 9.1 which dropped Python 3.11 support. On Linux this is masked by lazy evaluation — all deps have pre-built wheels so sphinx (a transitive build dep via ctranslate2 → torch → ... → pyopenssl → sphinx-hook) is never forced. On darwin, some packages lack wheels and build from source, triggering the full build-dep chain.

• Upgrade python311 → python312 across python.nix, packages.nix, devShell.nix
• Update container venv provisioning in nixosModules.nix from 3.11 → 3.12
• Add pyarrow to aarch64-darwin prebuilt overrides (fixes macOS test_orc.py failure reported by @dephiros in [Bug]: nix run fails — sphinx-9.1.0 not supported for python3.11 #9526)
• Add cross-eval Nix check that evaluates the package derivation for all supported platforms from Linux CI — would have caught this

Thanks to @dephiros for the report and macOS pyarrow finding. @boozedog also addressed this in #11621.

Fixes #9526

Test plan

• nix build succeeds (x86_64-linux)
• nix build .#checks.x86_64-linux.cross-eval passes (evaluates aarch64-darwin without sphinx error)
• Verified check catches the bug: with python311, cross-eval fails on aarch64-darwin
• nix run .# -- setup works on macOS