Fix CI coverage and Nix build validation

[devnullvoid]

Summary

• Run normal PR CI for both develop and master.
• Align the Nix build and development shell with Go 1.26 and refresh the stable package-set pin while retaining Intel macOS support.
• Replace silent Nix failures with a tested helper that only repairs pvetui dependency hash mismatches, rebuilds and smoke-tests the binary before committing, and restores the original hash if verification fails.
• Validate all advertised flake systems and relevant dependency, compiler, flake, and workflow changes; use read-only validation for fork PRs.
• Add regression coverage and update README, AGENTS.md, and CHANGELOG.md.

Fixes #172

Validation

• make build
• make test
• make code-quality
• actionlint for the changed workflows
• ShellCheck for the Nix helper
• nix flake check --all-systems --no-build
• Native Linux Nix build and binary smoke test
• bash scripts/update-nix-hash.sh --check

Hosted CI and Nix validation should now run on this PR targeting develop.