Add Nix flake CI: eval check + hash verification

Checks that the flake evaluates, and verifies the source, mixFodDeps,
and yarnOfflineCache hashes are correct. Does not do a full nix build
(which would be too slow for CI) — the hash checks catch the most
common issues before merging to config-nixos.

.gitea/workflows/nix-check.yml

@@ -0,0 +1,38 @@
+name: Nix Flake Check
+
+on:
+  push:
+    branches:
+      - master
+      - feature/*
+  pull_request:
+    branches:
+      - master
+  workflow_dispatch:
+
+jobs:
+  flake-check:
+    name: Nix Flake Check
+    runs-on: ubuntu-latest
+    if: "! contains(toJSON(github.event.commits.*.message), '[skip ci]')"
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v27
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+
+      - name: Check flake evaluates
+        run: nix flake check --no-build
+
+      - name: Verify source hash
+        run: nix build .#pinchflat.src --no-link --print-out-paths
+
+      - name: Verify mix deps hash
+        run: nix build .#pinchflat.mixFodDeps --no-link --print-out-paths
+
+      - name: Verify yarn cache hash
+        run: nix build .#pinchflat.yarnOfflineCache --no-link --print-out-paths