ci: share the build as a composite action

Replace the reusable workflow with .github/actions/build plus a nested
nix setup action, invoked as a step. CI and the next build stay a single
job (no extra runner or Nix restore); the release keeps its build/publish
split for credential isolation.

.github/actions/nix/action.yml

@@ -0,0 +1,14 @@
+name: Nix
+description: Install Nix and restore the store cache
+
+runs:
+  using: composite
+  steps:
+    - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+      with:
+        extra_nix_config: experimental-features = nix-command flakes
+    - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2
+      with:
+        primary-key: nix-v2-${{ hashFiles('flake.lock', '**/*.nix') }}
+        restore-prefixes-first-match: nix-v2-
+        gc-max-store-size-linux: 6G