fix(ci/nix): export USER before Nix steps so cachix runs in act_runner

Nix workflow on ubuntu-latest fails at the cachix-action step:

  $USER must be set. If running in a container, try setting USER=root.
  Error: The process /home/runner/.nix-profile/bin/cachix failed
  with exit code 1

cachix shells out to nix-env + cachix use, both of which require
HOME + USER set on the caller. On act_runner the job container does
not propagate USER from the host (it propagates HOME from /tmp/...
but not USER), so cachix exits 1 on a fresh container.

Although cachix-action has continue-on-error: true at the step
level, act_runner appears to bubble the failure up to the job
result anyway — possibly because the step exits before
continue-on-error catches it, or an act_runner deviation from
github-actions semantics. Either way the proper fix is to make
cachix not fail in the first place.

Add a pre-step to the composite action that exports USER for every
subsequent step. id -un resolves to root (the runner runs as root)
or whatever non-root user the container is configured for; falling
back to root if id -un is unavailable.

Test plan: re-run Nix / nix (ubuntu-latest) on the next push to
this branch; expect cachix-action to install + use the cache
successfully, and the job to pass overall.

Tracked next to fix/setup-uv-pin-version (PR #1) — separate concern,
separate PR.

.github/actions/nix-setup/action.yml

@@ -10,6 +10,22 @@ inputs:
 runs:
   using: composite
   steps:
+    # cachix-action requires the USER env var. It shells out to
+    # `nix-env -iA cachix` and `cachix use`, both of which expect
+    # HOME + USER set on the caller (Nix uses USER to scope per-user
+    # profile dirs). On act_runner the job container does not
+    # propagate USER from the host, so cachix fails with:
+    #
+    #   $USER must be set. If running in a container, try setting USER=root.
+    #
+    # Export USER once at the top of this composite so every
+    # subsequent Nix-using step inherits it.
+    - name: Ensure USER is set (act_runner / container compat)
+      shell: bash
+      run: |
+        if [ -z "${USER:-}" ]; then
+          echo "USER=$(id -un 2>/dev/null || echo root)" >> "$GITHUB_ENV"
+        fi
     - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
     - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
       with: