Add CI visibility for NixOS infrastructure changes in PRs

[danielnaab]

Goal

As a PR reviewer, I want to see when a pull request includes NixOS configuration changes and understand their impact so that infrastructure modifications receive appropriate scrutiny before merge.

Context

NixOS rebuilds are now decoupled from application deploys — merging to main no longer auto-applies system changes. However, reviewers may not notice that a PR touches infrastructure/nixos/ without explicit surfacing. A CI check that detects and comments on infrastructure changes closes this visibility gap.

Scope

• GitHub Action that triggers on PRs
• Detects changes in infrastructure/nixos/
• Comments on the PR with a summary of what changed (file-level diff)
• Optionally: validate NixOS configuration syntax in CI (e.g., nix flake check)

Acceptance Criteria

• PRs that modify infrastructure/nixos/ receive an automated comment highlighting the changes
• PRs that don't touch infrastructure get no comment (no noise)
• The check does not block merge — it's informational only