Cached checks, cachix push, and the cache declared for consumers

[clhodapp]

Brings flake-sync in line with the other public repositories on
caching and the binary cache.

• CI. The two-job check.yml (package + format, VM lifecycle)
  becomes the three-file set the other public repositories run:
  check.yml, main's copy, with the cached store, the two-hop trusted
  build for pull requests, the priority-pruned union entry, and the
  push of the kept roots' closure to the clhodapp cache from the
  cachix environment; check-pr.yml, the request's own copy,
  building only when .github/ changed; and cache-cleanup.yml at
  close. One job runs nix flake check, which covers what the two jobs
  did. Timeouts are 30 minutes; the VM lifecycle test took about seven
  on a cold runner.
• nixConfig declares the clhodapp cache and its two upstreams,
  honored when the flake is evaluated directly and the settings are
  accepted, as the other public flakes do.
• README gains the CI paragraph and the "Binary cache" section with
  the three substituters and keys a consumer needs.

actionlint passes on all three workflows; nix flake check --no-build
evaluates clean; nix fmt is clean. Because this changes .github/,
check-pr builds it; the first main run after merge is the first
push to the cache.

🤖 Generated with Claude Code