ci(nix): only run Nix CI on flake and packaging changes

[davidbudnick]

Summary

Stop running the two-arch Nix build on ordinary feature PRs. Nix CI now triggers on PRs only when the flake or packaging/linux actually changes. The Monday job still catches Cargo/source drift.

Why

Nix CI was matching Cargo.toml, Cargo.lock, crates/**/Cargo.toml, build.rs, icons, and the example config. That is most feature PRs. Each run is a full nix build on x86_64 and aarch64 (typically 17–20 minutes each, ~40 billed minutes per push). The workflow already has 658 runs. Linux cargo CI already compiles those same Cargo.toml changes.

Residual risk

A PR that adds a new native/system dependency without touching packaging/linux stays green until the Monday cron (or a manual workflow_dispatch). That is the tradeoff for not rebuilding Nix on every crate bump.

Test plan

• Confirm this PR itself still runs Nix CI (it touches .github/workflows/nix.yml)
• Confirm a HID/GUI-only PR no longer queues Nix CI after this merges

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Narrows when the Nix build workflow runs on pull requests.

The PR appears safe to merge.

Summary

Narrows pull-request Nix CI triggers to flake, Linux packaging, and relevant workflow changes. Scheduled and manually dispatched runs remain available to catch integration drift.

_{Reviews (2) · Last reviewed commit: "ci(nix): only run Nix CI on flake and pa..."}