fix(nix): refresh pins from current upstream DMG

[ilysenko]

Summary

• make the scheduled Nix refresh follow the verified current Codex.dmg payload even when Sparkle appcast lags
• keep appcast mismatch as a PR-body warning instead of a blocker
• refresh codexDmg.hash and codexVersion for the current 26.519.81530 DMG

Validation

• bash -n scripts/ci/update-nix-hashes.sh
• bash -n scripts/ci/validate-nix-pins.sh
• YAML parse for .github/workflows/*.yml
• bash -n over extracted workflow run snippets
• scripts/ci/validate-nix-pins.sh /tmp/Codex.dmg
• git diff --check

Notes

• Local full Nix build was not run because nix is not installed in this workspace; GitHub Actions will run the strict Nix Package Builds job.
• Supersedes fix: Update hash in flake.nix #328, which updates only the DMG hash and leaves codexVersion stale.