[AnthonyRonning]

Summary

• replace all 69 uses of the floating Nix installer with the immutable Determinate Nix action for v3.23.3
• pass an explicit source tag, withhold the installer GitHub token, and fail closed unless the installed runtime is Determinate Nix 3.23.3 / Nix 2.35.3
• enforce the pin and immediate runtime verification across every workflow with a flake-integrated policy test
• preserve the no-OIDC/no-FlakeHub boundary for the fork-compatible EIF and reviewer-gated signing jobs
• document the repository Nix runtime policy

Validation

• nix flake check --no-update-lock-file --print-build-logs (11 checks passed on aarch64-darwin)
• pre-commit workflow lint and Python policy suite (476 tests passed)
• targeted Nix, OpenSecret, Agent, Pages, SDK publishing, and signing workflow tests

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

Maple Auth development preview: https://e54f71cb.maple-auth-dev.pages.dev

Commit: c7899c85c1c7c29b883c761f07409805ecc6fb59

Uses development services. Cloudflare Access applies. Provider OAuth is not configured for PR URLs; use the stable Auth Dev host for OAuth rehearsal.

[github-actions]

Maple development preview: https://30d44ea2.maple-ca8.pages.dev

Commit: c7899c85c1c7c29b883c761f07409805ecc6fb59

Uses development API, billing, flags and PCR configuration. Cloudflare Access applies.