ci: use Determinate Nix while retaining Cachix #4592

User Story

As an OpenShell maintainer, I want CI to use the Determinate Nix action while keeping the existing OpenShell Cachix cache.

Description

Replace the installer in the shared setup-nix action with a commit-pinned DeterminateSystems/determinate-nix-action. Preserve public Cachix reads and authenticated uploads through CACHIX_AUTH_TOKEN.

Context

All existing setup-nix callers should inherit the installer change without changing their cache inputs or permissions.

Definition of Done

• Shared setup-nix installs Determinate Nix from a pinned action revision.
• Cachix remains configured before shell preparation and builds, with uploads disabled when no token is supplied.
• Affected workflow lint and composite-action security checks pass.