fix(nix): harden update script with GitHub token auth and add .gitattributes

[AmethystLiang]

Problem

The nix update script was vulnerable to GitHub API rate limits, and authentication code across multiple files contained duplicated logic for cookie decryption with hardcoded iteration counts that weren't suitable for all platforms. Temporary files in Windows DPAPI decryption used predictable names, and the action versions in CI weren't pinned.

Solution

Hardened the update script with GitHub token authentication, pinned GitHub action versions with full commit hashes, created reusable modules for shared utilities (cookie decryption, SQLite queries, type guards), made the decryption logic platform-aware with configurable iterations, and fixed security issues with temporary file handling by using UUIDs and proper permissions.

Key Changes

• Nix Update Script: Added GITHUB_TOKEN support to curl requests to reduce rate limit issues
• Action Version Pinning: Pinned all GitHub actions to specific commit hashes for reproducibility and security
• Code Organization: Extracted shared utilities into dedicated modules:
  • chromium-cookie.ts: Platform-aware cookie decryption with configurable iterations
  • firefox-profile.ts: Shared SQLite query logic
  • object-type-guards.ts: Reusable type checking utilities
• Security Improvements:
  • Windows DPAPI: Uses randomUUID() instead of Date.now() for temp file names
  • Temp file permissions: Set to 0o600 for restricted access
  • Improved JSON parsing with error handling
• Documentation: Added .gitattributes to mark flake.lock as linguist-generated (collapsed in GitHub diffs)
• Bug Fixes: Added missing has_more check in Slack channel history pagination

📋 Test Plan

• Run GITHUB_TOKEN=... ./scripts/update-nix-sources.sh locally and verify it fetches the latest release
• Verify flake.lock is collapsed by default in GitHub PR diffs
• Verify platform-specific iteration counts work correctly (1 for Linux, 1003 for macOS/Windows)
• Verify Windows DPAPI decryption generates unique temp file names on multiple runs