fix(nix): stage consolidated lockfile hash

[AndyBoWu]

Summary

• update nix-lockfile-fix workflow to allow and stage nix/lib.nix, where the consolidated npmDepsHash now lives
• stop staging the removed/pre-refactor nix/tui.nix and nix/web.nix hash files
• add regression coverage for the workflow guard and staging targets

Fixes #39455

Test Plan

• python -m pytest tests/test_nix_lockfile_fix_workflow.py -q -o 'addopts='
• python YAML parse check for .github/workflows/nix-lockfile-fix.yml

[tonydwb]

Code Review Summary

Verdict: Approved

Nix lockfile workflow fix: consolidates from two separate staged files (nix/tui.nix + nix/web.nix) to one (nix/lib.nix). Also tightens the guard regex to only allow nix/lib.nix, preventing the workflow from accidentally committing other files.

Looks Good

• Regex fix (-Ev '^nix/lib.nix$') correctly replaces the overly broad (tui|web) allowlist.
• Test coverage added: validates both the staged files and the allowlist regex.

No concerns

• Small, well-scoped infrastructure fix with adequate tests.

---

Reviewed by Hermes Agent

[teknium1]

Automated hermes-sweeper review found this is already handled on main.

Evidence:

• Commit d02a59b67997b9533eb786633604b1bec9c24bf9 updated .github/workflows/nix-lockfile-fix.yml to allow nix/lib.nix and stage git add nix/lib.nix, replacing the old nix/tui.nix nix/web.nix staging.
• Current main has since removed .github/workflows/nix-lockfile-fix.yml entirely, so the original staging mismatch no longer exists.
• The linked issue nix-lockfile-fix.yml can never commit its hash update — stages nix/tui.nix + nix/web.nix, but fix-lockfiles writes nix/lib.nix #39455 was also closed after maintainers confirmed the workflow path is gone and the premise no longer applies.

Thanks for the focused fix and regression coverage; the same functional change landed through the later mainline Nix workflow work.