fix(nix): update stale npmDepsHash and auto-fix on all lockfile changes

Hash mismatch was hidden by continue-on-error. Now the Nix Build
workflow fails visibly, and fix-nix-hash runs on every push/PR that
touches the lockfile (not just Dependabot).

.github/workflows/fix-nix-hash.yml

@@ -1,6 +1,11 @@
 name: Fix Nix hash
 
 on:
+  push:
+    branches: [main]
+    paths:
+      - 'package.json'
+      - 'package-lock.json'
   pull_request:
     paths:
       - 'package.json'
@@ -12,11 +17,10 @@ permissions:
 jobs:
   fix-nix-hash:
     runs-on: ubuntu-latest
-    if: github.actor == 'dependabot[bot]'
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.head_ref }}
+          ref: ${{ github.head_ref || github.ref }}
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - uses: actions/setup-node@v4

.github/workflows/nix-build.yml

@@ -32,7 +32,7 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
-    continue-on-error: true
+    continue-on-error: false
     steps:
       - uses: actions/checkout@v4