publish nix-cli binary cache in releases

[ethancedwards8]

Motivation

Let fleet machines substitute the nix-cli closure from the GitHub release instead of rebuilding Nix from source on every darwin-rebuild switch.

Context

The macOS pkg workflow now also builds .#nix-cli and exports its closure as a flat binary cache attached to the same release (<hash>.narinfo + <narhash>.nar.zst + nix-cache-info). Consumers add:

extra-substituters = https://github.com/exa-labs/nix-src/releases/download/<tag>
extra-trusted-public-keys = <public key of NIX_RELEASE_SIGNING_KEY>

narinfos are signed with the NIX_RELEASE_SIGNING_KEY repo secret when set (unsigned with a warning otherwise). narinfo URL: fields are rewritten from nar/<file>.nar.zst to the flat basename because release asset names cannot contain slashes.

Link to Devin session: https://app.devin.ai/sessions/45f5f87ecd904986bdbf211799db8c74
Requested by: @ethancedwards8

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring