Trust Homebrew taps in CI

[mikesplain]

Summary

• Move Homebrew tap trust into the nix-darwin Homebrew activation script instead of a standalone workflow step.
• Order the trust block after nix-homebrew recreates the managed Homebrew prefix and before nix-darwin runs brew bundle.
• Trust the managed non-official taps: hashicorp/tap, mikesplain/omlx, modem-dev/tap, and xykong/tap.

Root cause

The first attempt trusted taps before darwin-rebuild, but CI logs showed nix-homebrew then migrated/recreated Homebrew during activation. brew bundle subsequently failed on modem-dev/tap/hunk because the effective managed Homebrew setup still saw the tap as untrusted.

Validation

• git diff --check
• pre-commit run --files .github/workflows/nix-test.yaml darwin/homebrew.nix
• Temporary CI-style eval confirmed activation order: setup Homebrew prefixes, trust Homebrew taps, then Homebrew bundle.
• Temporary CI-style nix flake check --all-systems --no-build with defaultSystem=aarch64-darwin and defaultVersion=26

Not run locally: the full macOS darwin-rebuild switch workflow.