By: Tom Sydney Kerckhove <syd@cs-syd.eu>
Drop NixCI cachix push block; pull comes from the flake substituter The NixCI cachix block requires CACHIX_AUTH_TOKEN even though we only want to pull for now, which failed the suite. Cachix pull is already provided by the flake's nixConfig.extra-substituters (bombadil.cachix.org), which NixCI honors without credentials. The push block can be re-added with a token later.