fix: wait for the macOS Nix daemon before evaluation

[ORESoftware]

Problem

The exact deterministic-mise-export candidate passed the full frozen Nix graph on Ubuntu, but the macOS job failed before evaluating the repository because the newly installed Nix client fell back to direct store access:

error: opening lock file "/nix/var/nix/db/big-lock": Permission denied

The installer action had returned success, but the daemon socket was not yet usable. This is a workflow readiness race, not an exporter or Nix bridge semantic failure.

Repair

The permanent nix-interop workflow will:

• ping the ordinary store immediately on Linux;
• on macOS, retry NIX_REMOTE=daemon nix store ping up to 20 times;
• boundedly kick the installed org.nixos.nix-daemon LaunchDaemon between attempts;
• export NIX_REMOTE=daemon only after the daemon responds; and
• emit launchd/socket diagnostics and fail closed if readiness never arrives.

This prevents the client from silently falling back to root-owned local database access while retaining the same pinned Nix installer, locked Nixpkgs input, immutable registry, recursive fixed-output, tamper, and wrong-hash tests.

Publication guard

The branch begins with a temporary self-removing materializer. Do not merge while that file remains. The resulting product diff must contain only .github/workflows/nix-interop.yml.

Found by: #131
Related certification: zed-pkg-test/zed-pkg-e2e#49
Linear: DEN-1462, DEN-1411

[ORESoftware]

Independent test-org certification is now open in zed-pkg-test/nix-export-interop#9, pinned to exact head 55fd623730272f249f54fd614c1a3a79269dff2b.

The canary does not maintain a hand-copied readiness implementation: it extracts the unique Wait for the Nix store to become ready literal shell block directly from this candidate's .github/workflows/nix-interop.yml, validates the finite retry/diagnostic fragments, executes those exact bytes after the same pinned Nix installer action, and independently verifies the executed bytes still match the product workflow.

Ubuntu certifies the ordinary store-ping path. macOS certifies daemon ping, conditional NIX_REMOTE=daemon export, and locked Nixpkgs evaluation without direct-store permission fallback. Each platform uploads commit-addressed workflow/script digest evidence.

[linear-code]

DEN-3735