ci: install Nix via shell step instead of node24 JS action

act_runner v0.2.11 bundles an `act` that supports up to node20, but
DeterminateSystems/nix-installer-action@main moved to the node24 runtime,
so the job died with "runs.using ... got node24". Replace the JS action
with a plain single-user Nix install (--no-daemon, no systemd needed in
the catthehacker container) and set NIX_CONFIG at the job level so the
bare `nix flake check` still gets flakes. A run step has no node-runtime
coupling, so this won't break again when an action bumps its runtime.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/check.yml

@@ -26,17 +26,23 @@ on:
 jobs:
   eval-and-lint:
     runs-on: ubuntu-latest
+    # Flakes for every `nix` invocation in the job (the bare `nix flake
+    # check` below relies on this; the scripts pass the flag themselves).
+    env:
+      NIX_CONFIG: "experimental-features = nix-command flakes"
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@main
-        with:
-          # Match the runner's effective channel. Nomarchy itself tracks
-          # nixos-25.11 via flake.nix; the installer-action default is fine.
-          extra-conf: |
-            experimental-features = nix-command flakes
+        # Plain shell install rather than a JS action: act_runner's bundled
+        # `act` only supports up to node20, and nix-installer-action@main
+        # moved to node24 ("runs.using ... got node24"). A run step has no
+        # node-runtime coupling. Single-user (--no-daemon) needs no systemd,
+        # which the catthehacker container doesn't run as PID 1.
+        run: |
+          curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
+          echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH"
 
       - name: nix flake check --no-build
         run: nix flake check --no-build