ci: use logos-co/setup-nix-cache-action for Nix setup and caching (#83)

Replaces the per-repo installer + cachix pair with the shared action, which
installs Nix with the Logos Attic cache (cache.nix.logos.co) preconfigured and
publishes what the job builds — master to the public cache, every other ref to
ci.

Each converted job also gains

    environment: ${{ github.ref == 'refs/heads/master' && 'public-cache' || '' }}

because ATTIC_TOKEN_PUBLIC only exists inside that environment. Without it the
secret resolves empty on master and publishing is silently skipped — the job
still passes, so the omission would not surface as a failure.

The action installs Nix on every runner, macOS included. Sibling repos used
DeterminateSystems' installer there because cachix/install-nix-action collided
with the runner's pre-existing _nixbld users (eDSRecordAlreadyExists); that no
longer reproduces — logos-delivery-module converted the plain way and its
macos-latest leg passes — so the second installer is not carried over.

One property is deliberately not carried over: the old cachix step ran with
`continue-on-error: true` so a failed cache push could not fail a job whose
tests passed. The action exposes no equivalent, and adding one would also
swallow genuine setup failures now that the same step installs Nix rather than
only publishing at the end.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -35,6 +35,9 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest]
+    # ATTIC_TOKEN_PUBLIC only exists in the public-cache environment; master
+    # jobs must opt into it to publish to the public cache.
+    environment: ${{ github.ref == 'refs/heads/master' && 'public-cache' || '' }}
 
     runs-on: ${{ matrix.os }}
     timeout-minutes: 90
@@ -42,17 +45,13 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-
-      - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@main
-
-      - name: Setup Cachix
-        uses: cachix/cachix-action@v15
-        with:
-          name: logos-co
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-
       # The runner is the shared `doctest` CLI, invoked directly via its flake
+
+      - name: Setup Nix and Logos cache
+        uses: logos-co/setup-nix-cache-action@v1
+        with:
+          attic-token-ci: ${{ secrets.ATTIC_TOKEN_CI }}
+          attic-token-public: ${{ secrets.ATTIC_TOKEN_PUBLIC }}
       # (github:logos-co/logos-doctest). The flake bundles Python + PyYAML
       # (+ rich), so no pip install step is needed.
       - name: Test - UI chain + Composing Modules + Dependency Interfaces (C Library tutorial pulled in via requires)