ci(nix): unify cached verification and strengthen packaged smoke

Run deterministic installer and publisher checks in Nix, align dev and release dependency artifacts, narrow derivation inputs, and use content-aware CI cache keys. Replace duplicate Cargo gates with a Nix pre-push gate; validate JSON streams and cache data in representative packaged-binary smoke cases.

flake.nix

@@ -26,14 +26,18 @@
           curl-impersonate
           mupdf
         ];
-        # Only the crate itself (manifests, src/, tests/), so doc or script
-        # edits do not invalidate the Rust derivations.
+        # Keep integration-test edits out of the installed package's inputs.
+        # Fixtures stay here because provider code embeds some of them.
         rustFiles = [
           ./Cargo.toml
           ./Cargo.lock
           ./src
-          ./tests
+          ./tests/fixtures
         ];
+        testSrc = lib.fileset.toSource {
+          root = ./.;
+          fileset = lib.fileset.unions (rustFiles ++ [ ./tests ]);
+        };
         src = lib.fileset.toSource {
           root = ./.;
           fileset = lib.fileset.unions rustFiles;
@@ -42,15 +46,21 @@
           inherit src;
           pname = cargoManifest.package.name;
           version = cargoManifest.package.version;
+          CARGO_PROFILE = "dev";
           strictDeps = true;
           nativeBuildInputs = with pkgs; [ pkg-config ];
           buildInputs = with pkgs; [ openssl ];
         };
-        # Dependency-only build keyed on Cargo.toml/Cargo.lock: reused from the
-        # Nix store (or binary cache) until the dependency graph changes.
-        cargoArtifacts = craneLib.buildDepsOnly commonArgs;
+        # Checks and cargo package verification use dev artifacts; the shipped
+        # application has a separate release dependency cache.
+        cargoArtifacts = craneLib.buildDepsOnly (commonArgs // { src = testSrc; });
+        releaseCargoArtifacts = craneLib.buildDepsOnly (commonArgs // {
+          CARGO_PROFILE = "release";
+          doCheck = false;
+        });
         idxPackage = craneLib.buildPackage (commonArgs // {
-          inherit cargoArtifacts;
+          cargoArtifacts = releaseCargoArtifacts;
+          CARGO_PROFILE = "release";
           doCheck = false;
           nativeBuildInputs = commonArgs.nativeBuildInputs ++ [ pkgs.makeWrapper ];
           postInstall = ''
@@ -106,6 +116,30 @@
           '';
           meta.mainProgram = "idx-ownership-publish";
         };
+        installerSrc = lib.fileset.toSource {
+          root = ./.;
+          fileset = lib.fileset.unions [ ./install.sh ./scripts/install-sh-test.sh ];
+        };
+        installerCheck = shell: pkgs.runCommand "idx-installer-${shell}" {
+          nativeBuildInputs = with pkgs; [
+            bash coreutils curl dash findutils gnugrep gnused gawk python3
+          ];
+        } ''
+          cp -r ${installerSrc}/. .
+          chmod -R u+w scripts
+          patchShebangs scripts
+          export HOME="$TMPDIR"
+          INSTALL_SH_SHELL=${shell} bash scripts/install-sh-test.sh
+          touch "$out"
+        '';
+        publisherTestSrc = lib.fileset.toSource {
+          root = ./.;
+          fileset = lib.fileset.unions [
+            ./scripts/publish-ownership-snapshot-test.sh
+            ./scripts/publish-ownership-snapshot.sh
+            ./scripts/build-ownership-snapshot.sh
+          ];
+        };
       in
       {
         packages.default = idxPackage;
@@ -117,14 +151,23 @@
         };
         checks = {
           default = idxPackage;
-          ownership-publisher = ownershipPublisher;
-          fmt = craneLib.cargoFmt { inherit src; };
+          ownership-publisher = pkgs.runCommand "idx-ownership-publisher-smoke" { } ''
+            ${ownershipPublisher}/bin/idx-ownership-publish --help
+            touch "$out"
+          '';
+          fmt = craneLib.cargoFmt { src = testSrc; };
           clippy = craneLib.cargoClippy (commonArgs // {
             inherit cargoArtifacts;
+            src = testSrc;
+            doInstallCargoArtifacts = false;
+            installPhaseCommand = "touch $out";
             cargoClippyExtraArgs = "--all-targets -- -D warnings";
           });
           test = craneLib.cargoTest (commonArgs // {
             inherit cargoArtifacts;
+            src = testSrc;
+            doInstallCargoArtifacts = false;
+            installPhaseCommand = "touch $out";
             # Ownership discover tests point IDX_CURL_IMPERSONATE_BIN at plain
             # `curl` against a local fixture server.
             nativeCheckInputs = [ pkgs.curl ];
@@ -137,6 +180,7 @@
             src = lib.fileset.toSource {
               root = ./.;
               fileset = lib.fileset.unions (rustFiles ++ [
+                ./tests
                 ./LICENSE
                 ./README.md
               ]);
@@ -146,11 +190,12 @@
             installPhaseCommand = "touch $out";
           });
           smoke-mock = pkgs.runCommand "idx-smoke-mock"
-            { nativeBuildInputs = with pkgs; [ bash coreutils findutils gnugrep gnused gawk ]; }
+            { nativeBuildInputs = with pkgs; [ bash coreutils diffutils findutils gnugrep gnused gawk jq ]; }
             ''
-              cp -r ${./scripts} scripts
-              chmod -R u+w scripts
-              patchShebangs scripts
+              mkdir -p scripts
+              cp ${./scripts/live-smoke.sh} scripts/live-smoke.sh
+              chmod u+w scripts/live-smoke.sh
+              patchShebangs scripts/live-smoke.sh
               # The mock provider reads fixtures relative to the working dir.
               mkdir -p tests
               cp -r ${./tests/fixtures} tests/fixtures
@@ -159,6 +204,28 @@
               bash scripts/live-smoke.sh --bin ${idxPackage}/bin/idx --no-build --mode mock
               touch "$out"
             '';
+          install-script-sh = installerCheck "sh";
+          install-script-dash = installerCheck "dash";
+          shellcheck = pkgs.runCommand "idx-shellcheck" {
+            nativeBuildInputs = [ pkgs.shellcheck ];
+          } ''
+            shellcheck -s sh ${installerSrc}/install.sh
+            shellcheck ${installerSrc}/scripts/install-sh-test.sh
+            shellcheck ${./scripts/live-smoke.sh}
+            touch "$out"
+          '';
+          publisher-test = pkgs.runCommand "idx-publisher-test" {
+            nativeBuildInputs = with pkgs; [
+              bash coreutils findutils gawk gnugrep gnused jq sqlite
+            ];
+          } ''
+            cp -r ${publisherTestSrc}/. .
+            chmod -R u+w scripts
+            patchShebangs scripts
+            export HOME="$TMPDIR"
+            bash scripts/publish-ownership-snapshot-test.sh
+            touch "$out"
+          '';
         };
 
         devShells.default = pkgs.mkShell {
@@ -169,6 +236,8 @@
             cargo-watch
             cargo-nextest
             prek
+            jq
+            diffutils
           ] ++ runtimeDeps;
 
           shellHook = ''