Speed up Nix-based CI

[gmile]

Summary

• add a headless .#ci Nix shell using beamMinimal29Packages
• use that shell for CI and release Mix commands while preserving the full local developer shell
• add toolchain-aware fallback caches for dependencies, build artifacts, and Dialyzer PLTs
• include flake.nix in build and PLT cache invalidation
• cancel superseded runs for the same workflow and ref

Why

The 6m15s release-commit CI run spent 3m12s building an empty Dialyzer PLT, 38s compiling without a build cache, and 33s realizing the full Nix shell. The full OTP/Elixir closure is 1.1 GiB because it includes wx, WebKitGTK, GStreamer, and systemd; the locked minimal OTP 29 package set is 222.6 MiB and still provides Elixir 1.20.2, OTP 29.0.3, Hex 2.5.1, and Rebar 3.27.0.

Exact cache keys remain authoritative. Restore prefixes only reuse artifacts built with the same flake.nix/flake.lock toolchain, allowing Mix and Dialyxir to incrementally update them after dependency changes instead of rebuilding from zero.

Measured GitHub Actions results

Run	Total	Compile	Dialyzer	Soffice image
Baseline cold	6m15s	38s	3m12s	79s including Buildx setup
This PR cold	4m22s	32s	2m31s	31s including Buildx setup
This PR warm	1m13s	1s	4s	25s including Buildx setup

The cold run is 1m53s (30%) faster than the baseline. Once the toolchain-aware caches are populated, the workflow is 5m02s (80%) faster than the cold baseline and 1m00s (45%) faster than the prior 2m13s warm path.

Impact

• substantially less Nix data downloaded by fresh GitHub runners
• dependency updates can reuse a same-toolchain PLT and _build tree
• stale PR pushes and superseded main runs stop consuming Actions time
• local development retains the full OTP distribution and benchmark tooling

Local validation

• nix flake check
• x86_64-linux default and ci shell derivations evaluated
• actionlint 1.7.12 passed both workflows
• 48 unit tests passed through nix develop .#ci
• 93 tests passed against LibreOffice 26.2.4.2 through nix develop .#ci
• Dialyzer: 0 errors
• documentation and Hex audit passed
• mix hex.build succeeded through the minimal shell