ci(nix): unify cached verification and strengthen packaged smoke

Run deterministic installer and publisher checks in Nix, align dev and release dependency artifacts, narrow derivation inputs, and use content-aware CI cache keys. Replace duplicate Cargo gates with a Nix pre-push gate; validate JSON streams and cache data in representative packaged-binary smoke cases.

.pre-commit-config.yaml

@@ -7,24 +7,10 @@ repos:
 
   - repo: local
     hooks:
-      - id: cargo-fmt
-        name: cargo fmt
-        entry: cargo fmt --check
+      - id: nix-flake-check
+        name: nix flake check
+        entry: nix flake check -L
         language: system
-        types: [rust]
-        pass_filenames: false
-
-      - id: cargo-clippy
-        name: cargo clippy
-        entry: cargo clippy -- -D warnings
-        language: system
-        types: [rust]
-        pass_filenames: false
-
-      - id: cargo-test
-        name: cargo test
-        entry: cargo nextest run
-        language: system
-        types: [rust]
         pass_filenames: false
+        always_run: true
         stages: [pre-push]