ci(nix): auth api.github.com fetches to avoid transitive 401s

Transitive flake inputs (e.g. nix-community/pyproject.nix pinned via
uv2nix/build-system-pkgs) fetch tarballs from api.github.com without
auth and intermittently get 401/rate-limited, failing the Nix workflow
on otherwise-passing PRs.

Pass GITHUB_TOKEN to nix.conf's access-tokens setting via the installer's
extra-conf input. The token is auto-issued per run, scoped to this repo,
and read-only for fork PRs — no new secret exposure.

.github/actions/nix-setup/action.yml

@@ -11,6 +11,13 @@ runs:
   using: composite
   steps:
     - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+      with:
+        # Authenticate api.github.com tarball fetches so transitive flake inputs
+        # (e.g. nix-community/pyproject.nix pinned via uv2nix/build-system-pkgs)
+        # don't hit anonymous 401/rate-limit errors. GITHUB_TOKEN is auto-issued
+        # per workflow run and scoped read-only for fork PRs.
+        extra-conf: |
+          access-tokens = github.com=${{ github.token }}
     - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
       with:
         name: hermes-agent