Automate CI refresh after verified Nix hash commits #177

Follow-up discovered while validating Dependabot PRs #175 and #176 after #173.

The Nix helper correctly rebuilds and smoke-tests the dependency hash, then the updater commits flake.nix using GITHUB_TOKEN. GitHub suppresses normal workflow triggers from those token-created pushes, so the updated PR head does not automatically receive fresh Test/Lint/build checks.

Observed on #175: the updater created head 37d0e01 while dependency CI was still associated with the preceding head. The final-head statusCheckRollup was empty. A maintainer close/reopen cycle successfully triggered full validation on the final head.

Tasks:

• Choose a secure way to trigger validation on the final verified-hash head, or restructure hash updates so the ordinary PR checks validate the final commit automatically.
• Preserve read-only behavior for fork PRs and avoid privileged execution of untrusted PR code.
• Prevent bot-trigger loops and duplicate unnecessary builds.
• Document any required credentials or maintainer workflow, with regression coverage for the trigger behavior where practical.

Acceptance: dependency PRs finish with current checks on their actual final commit without a manual close/reopen cycle. The existing hash verification itself is working; this tracks the remaining orchestration improvement.