ci: add nix build check to catch vendorHash drift (GH#3298) (#3364)

Adds a CI job that runs `nix build .#default` on PRs touching go.mod,
go.sum, default.nix, flake.nix, or flake.lock, so dependabot bumps
that invalidate vendorHash fail loudly in CI instead of silently
breaking Nix users on main (as happened in GH#3221).

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/nix-build.yml

@@ -0,0 +1,31 @@
+name: nix build
+
+on:
+  pull_request:
+    paths:
+      - 'go.mod'
+      - 'go.sum'
+      - 'default.nix'
+      - 'flake.nix'
+      - 'flake.lock'
+  push:
+    branches: [main]
+    paths:
+      - 'go.mod'
+      - 'go.sum'
+      - 'default.nix'
+      - 'flake.nix'
+      - 'flake.lock'
+  workflow_dispatch:
+
+jobs:
+  nix-build:
+    name: nix build .#default
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Install Nix
+        uses: DeterminateSystems/determinate-nix-action@v3
+      - name: Build
+        run: nix build .#default --print-build-logs

CONTRIBUTING.md

@@ -344,6 +344,8 @@ docker run --rm -v $(pwd):/workspace -w /workspace nixos/nix \
 
 If the build fails with a `vendorHash` mismatch, update `default.nix` with the `got:` hash from the error message and rebuild.
 
+The `nix build` CI job (`.github/workflows/nix-build.yml`) runs on any PR that touches `go.mod`, `go.sum`, `default.nix`, `flake.nix`, or `flake.lock`, so dependabot bumps that invalidate `vendorHash` fail loudly instead of silently breaking Nix users on main.
+
 ### Debugging
 
 Use Go's built-in debugging tools:

issues.jsonl

@@ -0,0 +1 @@
+{"id":"bd-main-idj","title":"Pattern-collapse pass: mechanical cruft inventory and reduction","description":"Quantify near-duplicate functions, dead code, single-call helpers, single-impl abstractions, redundant defensive checks, and orphaned config keys across the CLI. Execute easiest 10-20% mechanically, run tests, stage but do not merge.","status":"in_progress","priority":2,"issue_type":"chore","owner":"maphew@gmail.com","created_at":"2026-04-18T16:19:12Z","created_by":"matt wilkie","updated_at":"2026-04-18T16:30:16Z","started_at":"2026-04-18T16:30:16Z","dependency_count":0,"dependent_count":0,"comment_count":0}