Lint Nix in CI

[thomasjm]

Adds checks.<system>.lint-nix, built by a new lint-nix CI job and by nix flake check. Run it locally with .aliases/dev-lint-nix.

deadnix is enforced. It found 104 unused arguments and let bindings, including three that were real:

• modules/kernels/python/.../language_server_pyright/config.nix built a pyrightWrapped wrapper setting PYTHONPATH to the kernel's env, then launched the unwrapped binary — so pyright never saw the kernel's site-packages. The dead wrapper is removed here; actually wiring it up wants its own change and a test.
• modules/kernels/r-ark/default.nix had kernelName = "R (Ark)", dead since that kernel has no language server, with the name hardcoded twice elsewhere.
• modules/kernels/rust/default.nix passed darwin.apple_sdk.frameworks.{CoreServices,Security} into evcxr, which never referenced them.

Three arguments are suppressed with # deadnix: skip rather than removed: isCodeDown in default.nix (codedown.nix finds it via builtins.functionArgs), self in flake.nix (Nix always passes it, so dropping it breaks evaluation outright), and typstToUse in the two typst files, whose TODOs are the reason to keep it.

Generated and vendored Nix is excluded — node2nix and cabal2nix output, and the julia-modules files copied from nixpkgs, where tidying dead code would only make the next re-vendor harder to diff.

statix is configured in statix.toml but not enforced: nix/lint.nix has enableStatix ? false. It still reports ~110 findings, all style rather than bugs (71 x = y.x; that could be inherit (y) x;, plus redundant parens and [] ++ xs). statix fix applies nearly all of it; that's a follow-up PR. repeated_keys is disabled permanently — it fires on the module-config style every sample environment uses.

Verified with nix flake check and by building .#sample_environment_r.