[hakula139]

Summary

Retain release Nix packages in Cachix so pinned consumers can reuse the package built with upstream's locked dependencies.

• Cache retention: share a tag-based Nix publisher between releases and manual cache repair. After exact-tag CI passes, push and pin the Linux and macOS closures before publication. Each tag/system has its own pin so newer releases retain earlier release closures.
• Release assets: require all three archives and sidecars through native GitHub CLI input validation before creating the release.

Refs #802. Closes #707.

Test plan

• Full repository checks passed before the final workflow changes. The final workflow changes passed actionlint, commit hooks, and final-head CI.
• No dispatch, cache push, cache pin, tag or release was created. Tagged publication remains unexecuted.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!