Exercise supported Nix packages in CI #727

Proposal

Continuously verify the advertised Nix installation surface: evaluate the flake, build a representative Linux package and run its installed maco --version. Qualify advertised Darwin outputs on a supported runner, or clearly narrow the support statement.

Background and evidence

At main fa0c79b9ae38eca2c59b2b1911becfe1a6b3c9ab, docs/PACKAGING.md:12-35 presents nix profile install and nix run as supported installation paths. flake.nix:16-21 exports four Linux/Darwin systems; lines 56-128 define the source fileset, release package and install check.

The public workflows do not evaluate/build the flake. .github/workflows/supply-chain.yml:48-52 verifies Cargo metadata/package creation, while portable-build verifies Rust builds. Neither checks Nix expression evaluation or the package fileset.

Thus a Nix-only expression/fileset/platform regression can merge despite green Rust and supply-chain checks. This is a missing distribution gate, not a claim that the current flake build fails.

Acceptance criteria

• Run nix flake check or equivalently scoped output evaluation under locked inputs.
• Build nix build .#maco on representative Linux CI and execute the installed binary's version smoke test.
• Verify a Darwin package on an appropriate runner, or explicitly distinguish unqualified outputs from continuously verified support.
• Integrate the relevant result with merge requirements and existing CI failure intake.
• Exercise a negative package-fileset fixture or equivalent test demonstrating that missing build inputs fail the gate.

Advantages

Validates the actual supported distribution path and catches defects Cargo-only checks cannot observe.

Disadvantages and costs

Nix evaluation/build adds runner time, downloads and cache maintenance; Darwin qualification may require separate capacity. The gate should be scoped and cached without treating evaluation alone as a successful installation.

Scope and verification

Nix package/dev-shell outputs, packaging docs and workflows. Source/workflow audit only; no Nix build or installation was performed. Distinct from #220/#612 foundations; no open Issue/PR supplies this gate.