fix(nix): stage consolidated lockfile hash

[rylena]

Summary

• Update nix-lockfile-fix.yml to whitelist and stage the consolidated nix/lib.nix hash file.
• Apply the same nix/lib.nix guard to the manual PR fix path before committing.
• Refresh workflow comments so the safety invariant matches the current single-hash file layout.

Verification

• python - <<'PY' ... yaml.safe_load(...) to parse .github/workflows/nix-lockfile-fix.yml and assert stale nix/tui.nix / nix/web.nix references are gone
• Shell guard checks confirming nix/lib.nix is allowed and old/package paths are rejected
• git diff --check -- .github/workflows/nix-lockfile-fix.yml
• Static added-line security scan
• Independent delegated code review: passed

Closes #39455

[alt-glitch]

Duplicate of #39459 (also #39475, #39814, #41004) — all fix #39455 by staging consolidated nix/lib.nix instead of the removed per-package hash files. Consolidating on the earliest open PR.

[rylena]

Closing this as a duplicate of #39459 for the same #39455 fix, per the maintainer triage note, so effort stays concentrated on the earlier open PR. I also verified #39459 is still open.