feat: add Garnix CI and binary cache

[stackptr]

Summary

• Add garnix.yaml to build nixosConfigurations, darwinConfigurations, devShells, and checks
• Add cache.garnix.io as a substituter in flake.nix so local builds pull CI-cached artifacts

Setup

1. Install the Garnix GitHub App on this repo
2. Merge this PR — Garnix will start building on subsequent pushes

Verification

After Garnix completes a build, confirm local builds pull from the cache:

# Check if a specific output is in the Garnix cache
nix path-info --store https://cache.garnix.io .#nixosConfigurations.glyph.config.system.build.toplevel

# Watch for Garnix cache hits during a build
nix build .#nixosConfigurations.glyph.config.system.build.toplevel -v 2>&1 | grep "copying path.*from 'https://cache.garnix.io'"

Lines like copying path '/nix/store/...' from 'https://cache.garnix.io'... confirm artifacts are being fetched from Garnix.

Cleanup after verification

Once Garnix is confirmed working, follow up with:

• Remove .github/workflows/ci.yml (Garnix replaces GitHub Actions CI)
• Remove the CACHIX_AUTH_TOKEN repository secret
• Remove stackptr.cachix.org from extra-substituters and extra-trusted-public-keys in flake.nix
• Remove pkgs.cachix from the devShell in flake.nix

🤖 Generated with Claude Code

[stackptr]

Closing for #355