Publish Linux nix-cli release caches and the signing public key

[ethancedwards8]

Motivation

Releases currently carry only the aarch64-darwin nix-cli closure (built for the macOS .pkg), so Linux consumers (agent sandboxes via monorepo bin/setup_nix.sh, exa-labs/monorepo#122820) can't substitute the fork from the GitHub release and have to rely on the exa S3 cache.

Context

Extends the release workflow so each release is a complete multi-system binary cache:

• New linux-cache matrix jobs (x86_64-linux on ubuntu-latest, aarch64-linux on ubuntu-24.04-arm) build .#nix-cli, run make-release-cache.sh, rename the closure root file to store-paths-<system>, and upload the flat cache as a workflow artifact. No FlakeHub cache action in these jobs — they build self-contained.
• The pkg job renames its darwin root to store-paths-aarch64-darwin (keeping the legacy store-paths), merges the Linux cache artifacts into the release asset set (skipping already-present content-addressed nar/narinfo names), and publishes public-key (derived from NIX_RELEASE_SIGNING_KEY via nix key convert-secret-to-public) so consumers can pin the narinfo signing key.

Consumers then substitute per-system:

url=https://github.com/exa-labs/nix-src/releases/download/<tag>
nix copy --from "$url" $(curl -sL "$url/store-paths-$(nix eval --raw --impure --expr builtins.currentSystem)")
# trusting: $(curl -sL "$url/public-key")

Link to Devin session: https://app.devin.ai/sessions/e37fd6958cca4b16b5995b723d52a907
Requested by: @ethancedwards8

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring