ci: install Determinate Nix in shared setup action

[SDAChess]

Summary

Use Determinate Nix for CI jobs through the shared setup-nix action, while retaining the existing OpenShell Cachix cache.

Related Issue

Closes #4592. Author has verified ADMIN access; the issue does not have state:accepted.

Changes

• Replace cachix/install-nix-action with commit-pinned DeterminateSystems/determinate-nix-action v3.23.2 and use its github-token input.
• Keep Cachix setup before builds, authenticated uploads, and read-only access without a token.

Testing

• Actionlint passes for workflows calling the shared Nix and protobuf compatibility actions.
• Zizmor reports no findings for the modified composite action.
• git diff --check passes.
• Full repository Actionlint reports existing concurrency.queue errors in unchanged publish-docs-website.yml and sync-docs.yml.
• Installation and Cachix downloads/uploads require validation on GitHub-hosted CI.
• The pre-commit hook could not run because mise failed to install Python/Node toolchains on this NixOS host; committed with that hook bypassed after the scoped checks above passed.
• Unit and E2E tests are not applicable to this installer-only change.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs: not applicable.