Stabilize CI tool setup

[emil-e]

Summary

• install Emacs via a pinned purcell/nix-emacs-ci flake revision instead of resolving HEAD in every job
• install Nix explicitly with the GitHub token available to reduce GitHub API throttling
• pin macOS jobs to macos-26 and use platform-specific Zig cache keys

Verification

• Ruby YAML parse for .github/workflows/ci.yml
• bash -n .github/scripts/install-emacs.sh
• git diff --check

Note: local sandbox blocks network, so the pinned flake fetch is left to CI.