ci(nix): restore nix CI as trigger-only workflow with local entrypoint

[alt-glitch]

Summary

Restores nix CI (ripped out in 9eb0bcd "to be re-added later when we have more stable ci flows") in a deliberately minimal, opt-in form:

• Triggers only on workflow_dispatch (job: check|build) or adding the ci/nix label to a PR — no push/PR auto-runs, so it costs nothing until asked.
• scripts/nix-ci.sh is the single entrypoint: check = nix flake check -L (16 checks on x86_64-linux), build = cold-builds .#default .#tui .#web .#desktop. Devs run exactly what CI runs.
• Reuses the orphaned-but-intact .github/actions/nix-setup composite (Determinate installer + Cachix hermes-agent, CACHIX_AUTH_TOKEN optional).
• The old workflow's stale-npmDepsHash diagnosis/auto-fix machinery is not restored: since fix(nix): hashless npm deps via importNpmLock (salvage #48213) #48883 (importNpmLock, hashless) that failure class is structurally gone, and .#fix-lockfiles no longer exists.

Note for merging: the ci/nix label needs to exist once (gh label create ci/nix --description "run nix CI on this PR").

Test plan

• YAML validated (PyYAML + yq), bash -n scripts/nix-ci.sh, mode 755
• scripts/nix-ci.sh check locally = the same nix flake check -L that passed green today at cbc1054
• Trigger gating: job-level if requires dispatch or exact label ci/nix

[github-actions]

૮ >ﻌ< ა ci review

_{running on 10526c3}

⚠️ Action required

CI-sensitive file review · View job

This PR changes CI-sensitive files (eslint config, workflow YAMLs, or composite actions). These influence what the js-autofix job executes and pushes to main.

How to fix:

Add the ci-reviewed label after verifying:

• no new eslint rules with custom fix functions that write outside linted paths,
• no workflow changes that widen permissions or remove guards,
• no composite action changes that alter what gets executed.

---

CI timings

CI timings · View job

Wall time 7m46s vs 9m59s (-22.2%). 10 job(s) slower, 12 faster, 1 unchanged.

• Build&Test Docker image / build (amd64, ubuntu-latest, linux/amd64, type=gha,scope=docker-amd64, type=gha,mode=max,scope=do...: -139.0s
• Build&Test Docker image / build (arm64, ubuntu-24.04-arm, linux/arm64, type=gha,scope=docker-arm64, type=gha,mode=max,scope...: -39.0s
• Python tests / Run tests slice 1/8: +21.0s
• Python tests / Run tests slice 5/8: +18.0s
• Docs Site / docs-site-checks: +12.0s

[ak2k]

The trigger-only shape is a clean entrypoint, but as-is it doesn't restore the guard half of #53202 — only the manual tool. The failure class this is meant to catch (the electron-headers FOD in #61443, and #67056's tui source-filter break) has the defining property that it merges green — the networked Docker / npm ci paths never hit the FOD, so nothing goes red unless something builds the flake offline. An opt-in ci/nix label doesn't close that: it only fires when a human already suspects a nix break, which is exactly the case where you didn't need the guard.

#53202's guard closed it automatically — auto-triggered on the nix lane (nix/, flake.nix, flake.lock) or frontend, and required in all-checks-pass — so a desktop.nix or lockfile regression turned red before merge without anyone remembering. scripts/nix-ci.sh build already covers the right targets (superset of .#web .#tui .#desktop), so parity is just two wiring changes:

1. Add a pull_request trigger path-filtered to nix/**, flake.nix, flake.lock (keep workflow_dispatch + ci/nix for opt-in ad-hoc runs).
2. Make the build job required in the all-checks-pass gate.

Keep the label path for manual re-runs; just don't make it the only path. With those two, this fully supersedes #53202's guard and I'll close mine.

[alt-glitch]

Call-graph-assisted review — the change is a workflow YAML + a bash wrapper (no compiled code), so calldiff doesn't apply; reviewed via git diff and by checking the referenced action exists.

Restores Nix CI as a trigger-only workflow: workflow_dispatch (with a check/build choice) plus pull_request: [labeled] gated on the ci/nix label. That keeps the expensive Nix build off every push while leaving it one label/click away — sensible for this repo's cadence. scripts/nix-ci.sh is a clean case dispatcher with set -euo pipefail and a usage/exit-2 default.

🟡 Duplication / abstraction

• No duplication. .github/actions/nix-setup/action.yml already exists on main and is reused rather than re-inlined — good. The check/build split lives in one script instead of being duplicated across two jobs.

🔴 Issues

• CACHIX_AUTH_TOKEN behaviour on fork PRs. The trigger is pull_request (not pull_request_target), so for PRs from forks the token secret is unavailable and cachix-auth-token will be empty. That's the safe choice (no secret exposure to untrusted code), but it means cache push silently won't happen on labeled fork PRs — only read. Worth a one-line comment in the workflow so a future maintainer doesn't chase "why isn't the cache populating on that PR." Confirm the nix-setup action degrades gracefully (read-only) with an empty token rather than failing the step.
• Minor: concurrency.group: nix-${{ github.ref }} with cancel-in-progress: true means a re-label or new push cancels an in-flight run on the same ref. Fine for check; just be aware a long build dispatch can be cancelled by an unrelated push to the same ref.

✅ Looks good

• permissions: contents: read is appropriately minimal.
• fail-fast: false across the ubuntu/macos matrix so one platform's failure doesn't mask the other.
• timeout-minutes: 45 is a reasonable ceiling for a cold Nix build.
• Pinned actions/checkout by commit SHA (v6.0.2) — good supply-chain hygiene.