chore(nix): FOD hash automation, current runner labels, self-prune decommission, darwin-legacy pin

[levonk]

Summary

• Fix x86_64-darwin FOD hash (was pkgs.lib.fakeHash, now computed: sha256-B8YZsB+JRkG98nhZ71yrULSiOFBfbYJJVHcQ/SSf3yU=)
• Add nix-fod-hashes.yml workflow: 4-platform matrix builds qmd-node-modules FOD, collector job opens PR with updated hashes (addresses Toby's request in Nix fod build #55 and implements Mic92's suggested approach: "build matrix over the 4 architectures + collector job that updates the hashes file")
• Update nix.yml to current GitHub Actions runner labels (macos-26, macos-26-intel) — macos-13 is retired
• Migrate from cachix/install-nix-action to DeterminateSystems/nix-installer-action + magic-nix-cache-action (GitHub Actions cache, free, zero-config)
• Add self-prune job to nix.yml: detects validate-x86-darwin failure and opens a PR to either update to a newer Intel runner label or comment out the dead job + swap x86_64-darwin FOD hashes to lib.fakeHash (auto-clean on runner decommission)
• Pin x86_64-darwin to nixpkgs-26.05-darwin (last stable branch supporting x86_64-darwin; nixpkgs-unstable dropped it in 26.11)
• Add bun.lock and package.json to nix.yml path filter so dependency bumps trigger Nix CI

Files changed

• flake.nix — add nixpkgs-darwin-legacy input pinned to nixpkgs-26.05-darwin, use it for x86_64-darwin, fix x86_64-darwin FOD hash, expose qmd-node-modules as package output for CI
• flake.lock — updated for new nixpkgs-darwin-legacy input
• .github/workflows/nix.yml — rewritten: macos-26/macos-26-intel labels, DeterminateSystems installer + magic-nix-cache, nix flake check --all-systems --no-build, separate validate-x86-darwin and validate-aarch64-darwin jobs, self-prune decommission job, bun.lock/package.json path filters
• .github/workflows/nix-fod-hashes.yml — new: 4-platform matrix (ubuntu-latest, ubuntu-24.04-arm, macos-26-intel, macos-26) computes FOD hashes, collector job updates flake.nix and opens PR

Context

Toby's comment on closed PR #55:

"this is really neat. can you add a workflow to update the hashes on release tags?"

Mic92's follow-up:

"It's possible to have fod hashes for bun computed with nix in ci, but it basically requires using a build matrix over the 4 architectures to do so and a collector job that than actually updates the hashes file."

This PR implements both requests. The aarch64-linux hash remains pkgs.lib.fakeHash — the nix-fod-hashes workflow will compute it on first run (the ARM Ubuntu runner is needed for that).

Test plan

• nix build .#default succeeds on x86_64-darwin with the corrected hash
• nix run .#default -- --version outputs qmd 2.6.3
• nix flake check --all-systems --no-build passes (all 4 systems evaluate)
• actionlint validates both workflow YAML files
• Self-prune regex tested against actual nix.yml — correctly matches the validate-x86-darwin job block
• FOD hash swap regex tested against actual flake.nix — correctly matches and replaces the x86_64-darwin SRI hash
• CI runs on push (macos-26-intel, macos-26, ubuntu-latest) — verify after push
• nix-fod-hashes workflow computes aarch64-linux hash on first run