decide how we install upstream Nix in CI #31

Problem

setup-nix installs Nix via DeterminateSystems/nix-installer-action with
determinate: false, which makes the installer pass --prefer-upstream-nix. We use it to
get upstream Nix instead of Determinate Nix (avoiding the determinate-nixd binary and
FlakeHub auto-enablement).

Upstream announced this option would stop working on 2026-01-01. That date has passed
and the option still works — verified 2026-08-31:

• nix-installer-action at our pin (v22, ef8a1480) passes --prefer-upstream-nix in the
  determinate: false branch of installerArgs (src/index.ts).
• nix-installer main still maps prefer_upstream to Distribution::Nix
  (src/settings.rs, distribution()).

But the action's README (at our pin and on main) still documents the sunset, so this is
undocumented-support territory. The action always downloads the latest installer, so
pinning the action does not pin this behaviour: CI can flip to Determinate Nix with no
change on our side, on any run.

Why it matters

Every nix-based job in Solar and (after artifact-conduit#441) ARC goes through this one
action. A silent flip changes what Nix is installed across both products at once.

Options

1. Accept Determinate Nix — drop determinate: false. Simplest; means accepting
   determinate-nixd and FlakeHub auto-enablement, which we opted out of deliberately.
2. Move to cachix/install-nix-action — installs upstream Nix as its actual purpose,
   and we already depend on cachix for the cache. Needs a cold/warm timing comparison
   against the current installer.
3. Pin DeterminateSystems/determinate-nix-action — pins the installer version, but
   it is the Determinate distribution, so it does not solve the upstream-Nix requirement.

Leaning 2. Decide before the flip forces it.

Acceptance criteria

• A decision recorded, with the reason we do or do not need upstream Nix specifically.
• setup-nix updated accordingly, and the sunset comment in action.yml removed or
  replaced with the new rationale.
• Cold and warm CI runtime compared against today's baseline if the installer changes
  (solution-arsenal hack/bench-gha-step.sh, baselines in bench/).

Context

Raised by CodeRabbit on dev-kit#30 (comment claimed the flag was already non-functional;
that part is not yet true — the sunset risk is).