chore(nix): heal vendorHash on merge instead of on PR branch

[mmanciop]

Why

A dependency bump changes go.mod/go.sum, which makes the buildGoModule vendorHash in nix/package.nix go stale and the Nix build fail. The Nix vendorHash workflow was meant to recompute and push the fix automatically, but:

1. It's a security risk. It ran on pull_request, checked out the untrusted PR branch, ran nix build (executing dependency code from that branch), all in a job holding REPOSITORY_FULL_ACCESS_GITHUB_TOKEN. A poisoned/compromised dependency in a bump could exfiltrate that write-scoped PAT.
2. It's broken for Dependabot anyway. GitHub withholds Actions secrets from Dependabot-triggered runs, so the PAT resolved empty and checkout failed with Input required and not supplied: token (see PR #186 checks).

What

Retire nix-vendor-hash.yml. Instead:

• Skip the nix build on Dependabot PRs via a github.actor != 'dependabot[bot]' job guard. The hash is stale until the bump merges, so the check would only ever be red — a job-level skip reports skipped, which branch protection treats as passing. Human dependency changes still get the full build.
• Add an update-vendor-hash job to nix.yml that runs on push to main, recomputes the hash, and commits the fix. On main the code is trusted, so holding the PAT is safe — the untrusted-code-plus-write-token combination is gone.

Tradeoff

This is fix-forward: main's nix build is briefly red between the merge and the follow-up fix commit. Releases here are cut manually (prepare-release.yml workflow_dispatch → tag → release.yml), so that window cannot silently ship a broken package. The fix commit re-triggers the workflow, which then finds the hash correct and no-ops.

Follow-ups (not in this PR)

• Dependabot PR #186 still needs its one-line hash fix to merge (sha256-4Yu3y5wMcQcgD+lUfcOHjHoWkQ5v+2PZOrqvFOoNdVM=); this automation only takes over once it's on main.
• The REPOSITORY_FULL_ACCESS_GITHUB_TOKEN Dependabot secret is no longer needed by this workflow and can be removed if nothing else uses it.

🤖 Generated with Claude Code