[codex] Replace Cachix cache wiring with Attic

[zah]

Summary

• replace flake Cachix substituters with blocksense/metacraft Attic public caches
• remove Cachix Action setup from CI and configure Nix directly from Attic repo variables
• stop passing the legacy Blocksense infra Cachix token to the lock update workflow

Validation

• nix flake metadata --accept-flake-config --no-write-lock-file
• yq parse over .github workflows
• targeted rg check for owned Cachix cache/action references