Auto-fix stale nix vendorHash on dependabot PRs

[BradLugo]

Dependabot gomod bumps invalidate the vendorHash in flake.nix, which
would fail the nix check on every such PR. Compute the correct hash in
CI and push it to the dependabot branch instead of asking a human to.
Requires a NIX_AUTOFIX_PUSH_TOKEN dependabot secret, since GITHUB_TOKEN
pushes do not retrigger the PR checks.

This PR is part of a stack containing 5 PRs:

1. main
2. Fix nix flake build #247
3. Add nix flake build check to CI #248
4. Document nix flake install in README #249
5. "Auto-fix stale nix vendorHash on dependabot PRs" (this PR)
6. Enable dependabot updates for flake.lock #251

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• main

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Enterprise

Run ID: 0df942fa-b155-4ac0-a25c-e3be5f98e751

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch blugo/autofix-nix-vendorhash

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}