Add Cachix cache and CI workflow

nixos/ci/railbird-secrets-stub/flake.nix

@@ -0,0 +1,20 @@
+{
+  description = "CI stub for the private railbird-secrets flake";
+
+  # The real railbird-secrets flake declares these inputs; the parent flake's
+  # lockfile also wires them up. Declaring them here avoids noisy warnings when
+  # this stub is used via `--override-input railbird-secrets ...`.
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+    agenix.url = "github:ryantm/agenix";
+  };
+
+  outputs = { self, nixpkgs, flake-utils, agenix }: {
+    # Keep this minimal: NixOS flake currently doesn't use railbird-secrets, but
+    # Nix will still try to fetch/resolve all inputs during evaluation.
+    keys = {
+      kanivanKeys = [ ];
+    };
+  };
+}

nixos/flake.nix

@@ -418,6 +418,7 @@
         "http://192.168.1.26:5050"
         "https://cache.flox.dev"
         "https://org-agenda-api.cachix.org"
+        "https://colonelpanic8-dotfiles.cachix.org"
         "https://codex-cli.cachix.org"
         "https://claude-code.cachix.org"
       ];
@@ -425,6 +426,7 @@
         "1896Folsom.duckdns.org:U2FTjvP95qwAJo0oGpvmUChJCgi5zQoG1YisoI08Qoo="
         "flox-cache-public-1:7F4OyH7ZCnFhcze3fJdfyXYLQw/aV7GEed86nQ7IsOs="
         "org-agenda-api.cachix.org-1:liKFemKkOLV/rJt2txDNcpDjRsqLuBneBjkSw/UVXKA="
+        "colonelpanic8-dotfiles.cachix.org-1:O6GF3nptpeMFapX29okzO92eSWXR36zqW6ZF2C8P0eQ="
         "codex-cli.cachix.org-1:1Br3H1hHoRYG22n//cGKJOk3cQXgYobUel6O8DgSing="
         "claude-code.cachix.org-1:YeXf2aNu7UTX8Vwrze0za1WEDS+4DuI2kVeWEE4fsRk="
       ];

nixos/nix.nix

@@ -37,6 +37,7 @@
           "https://cache.railbird.ai?priority=45"
           "https://cuda-maintainers.cachix.org"
           "https://ai.cachix.org"
+          "https://colonelpanic8-dotfiles.cachix.org"
           "https://codex-cli.cachix.org"
           "https://claude-code.cachix.org"
         ];
@@ -44,6 +45,7 @@
           "cache.railbird.ai:KhnvcouxtIU2zxUcjJsm4bUK3o1S3p8xMf9qfZGF7/A="
           "cuda-maintainers.cachix.org-1:0dq3bujKpuEPMCX6U4WylrUDZ9JyUG0VpVZa7CNfq5E="
           "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc="
+          "colonelpanic8-dotfiles.cachix.org-1:O6GF3nptpeMFapX29okzO92eSWXR36zqW6ZF2C8P0eQ="
           "codex-cli.cachix.org-1:1Br3H1hHoRYG22n//cGKJOk3cQXgYobUel6O8DgSing="
           "claude-code.cachix.org-1:YeXf2aNu7UTX8Vwrze0za1WEDS+4DuI2kVeWEE4fsRk="
         ];