fix(nix): stage nix/lib.nix instead of removed per-package hash files

[liuhao1024]

What does this PR do?

Updates the nix-lockfile-fix.yml workflow to stage nix/lib.nix instead of the removed per-package hash files (nix/tui.nix, nix/web.nix). After the workspace lockfile consolidation in a51a7b9, the workflow can never commit its computed hash update.

Related Issue

Fixes #39455

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• .github/workflows/nix-lockfile-fix.yml: Update the file-whitelist guard regex from ^nix/(tui|web)\.nix$ to ^nix/lib\.nix$, and change git add in both the auto-fix-main and fix jobs from nix/tui.nix nix/web.nix to nix/lib.nix.

How to Test

1. Verify that fix-lockfiles writes to nix/lib.nix (not nix/tui.nix or nix/web.nix): nix run .#fix-lockfiles -- --apply and check git diff --name-only.
2. Verify the guard regex matches: echo "nix/lib.nix" | grep -E '^nix/lib\.nix$' should match.
3. Verify the old files are no longer staged: the workflow should only commit nix/lib.nix.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Code Intelligence

⚠️ GitNexus unavailable — grep-based fallback used.

• Checked files: .github/workflows/nix-lockfile-fix.yml, nix/lib.nix, nix/tui.nix, nix/web.nix
• Blast radius: LOW — single CI workflow file, no code changes
• Related patterns: a51a7b9 (consolidation commit), ba57ebec3 (hash bump)

[teknium1]

Thanks for the focused fix. This is an automated hermes-sweeper review.

• The same guard and both staging changes landed in d02a59b67997b9533eb786633604b1bec9c24bf9 (fix(nix): cold npm builds + fix-lockfiles real-build verification + auto-fix workflow (#41867)).
• The target workflow was then removed entirely in 9eb0bcd60fc6d3fe28e0b1c5bbe188f94169f65c (change(ci): rip out nix ci for now), so current main has no stale staging path.
• This also matches the maintainer resolution on linked issue nix-lockfile-fix.yml can never commit its hash update — stages nix/tui.nix + nix/web.nix, but fix-lockfiles writes nix/lib.nix #39455, which records that the workflow no longer exists and the reported mismatch is moot.