Restore dependency PR validation and align Nix Go toolchain #172

Found while reviewing Dependabot PRs #167, #168, and #169.

Observed gaps:

• .github/workflows/ci.yml runs pull_request CI only for master, while Dependabot PRs target develop. Those PRs have no normal test/lint/build checks before merge.
• The Nix vendor hash workflow reports success for build failures unrelated to a hash mismatch. Run https://github.com/devnullvoid/pvetui/actions/runs/38334382176 logs: go.mod requires go >= 1.26.0 (running go 1.25.0; GOTOOLCHAIN=local). The hash update commit is skipped.
• The current develop branch already requires Go 1.26; flake.nix uses the pinned buildGoModule default and a go_1_25 development shell. This predates the dependency updates.

Tasks:

• Run test/lint/build CI on pull requests targeting develop as well as master.
• Update/select a Nix Go toolchain compatible with go.mod and align the development shell.
• Recompute vendorHash against the final dependency set and validate nix build.
• Fail the hash workflow on unexpected build errors instead of returning success.
• Rebuild after any hash update so a green job means the resulting package was validated.

Acceptance: dependency PRs receive meaningful CI before merge, and Nix builds succeed using a compatible Go toolchain with an accurate vendor hash.