Sweep: repoint Nix CI consumers to dryvist/.github + remove personal copies

[JacobPEvans-personal]

Goal

Finish relocating the org's Nix CI to dryvist/.github. The reusable Nix workflows (_nix-validate.yml, _nix-build.yml) now live here (#13). The remaining consumers still reference the copies in JacobPEvans-personal/.github. Repoint them, then remove the orphaned personal copies.

Background

• Templates added to dryvist/.github: feat(workflows): add reusable Nix validate/build templates #13
• Rule updated to record the relocation: docs(rules): record Nix CI templates relocated to dryvist/.github ai-assistant-instructions#662
• First consumer migrated: fix(ci): drop FlakeHub cache, adopt shared nix-validate template nix-claude-code#33
• dryvist/* added to the zizmor trusted-publisher policy in feat(workflows): add reusable Nix validate/build templates #13 so @main self-references pass unpinned-uses.

Repoint consumers (one PR per repo, DRYVIST tier, SSH)

Swap only the uses: owner segment JacobPEvans-personal/.github → dryvist/.github for the Nix reusable workflows (_nix-validate.yml, _nix-build.yml), preserving path and @main. Test each repo's CI individually.

• dryvist/nix-darwin — .github/workflows/ci-validate.yml (and any _nix-build ref)
• dryvist/nix-ai — .github/workflows/ci-gate.yml
• dryvist/nix-home — .github/workflows/ci-gate.yml
• dryvist/nix-screenpipe (private) — .github/workflows/ci-gate.yml
• dryvist/nix-ai-server, dryvist/nix-pxe-bootstrap — on scaffold-branch merge

While repointing, confirm each repo's zizmor policy trusts the org self-references it uses. Note: JacobPEvans-personal/* is not in the trusted list, yet some consumers reference JacobPEvans-personal/.github/...@main for non-Nix shared workflows (_markdown-lint, _file-size, _python-security, _osv-scan) and currently pass — verify why (SHA-pinned? zizmor not scanning?) and add JacobPEvans-personal/*: ref-pin if those @main refs are real and unprotected.

Remove orphaned personal copies (after all consumers repointed)

• Delete _nix-validate.yml + _nix-build.yml from JacobPEvans-personal/.github — requires a gh-claude-private relaunch (PRIVATE tier); not doable from a DRYVIST session.

Optional follow-ups

• dryvist/nix-claude-code full ci-gate parity (paths-filter + file-size + python-security + merge-gate) to match nix-ai.
• Templatize the inline deps-update-flake.yml Determinate-installer usage across nix-home / nix-ai / nix-ai-server / nix-pxe-bootstrap.

Refs: #13