ci: install Nix with nix-quick-install-action in the docs job

.github/workflows/cachix.yml

@@ -15,6 +15,14 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
+      # Kept on the Determinate installer while check.yml and docs.yml moved to
+      # nixbuild/nix-quick-install-action. This is the only job that genuinely
+      # builds, and the fast installer gives single-user Nix: no daemon, no
+      # nixbld users, and no build sandbox on ubuntu-24.04, where unprivileged
+      # user namespaces are AppArmor-restricted. Nix's `sandbox-fallback`
+      # defaults to true, so it would disable the sandbox and retry rather than
+      # fail — silently publishing unsandboxed builds to a public cache. The
+      # ~20s is also only ~14% of a run dominated by the network anyway.
       - uses: DeterminateSystems/nix-installer-action@v22
 
       - uses: cachix/cachix-action@v17

.github/workflows/check.yml

@@ -11,6 +11,14 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
+      # Stays on the Determinate installer even though this job only evaluates,
+      # because nix-installer-action installs *Determinate* Nix and its parallel
+      # evaluator is worth more here than the slower install. Measured on this
+      # job: nixbuild/nix-quick-install-action (upstream Nix 2.34.7) cut the
+      # install from 8s to 1s but pushed `nix flake check` from ~30s to 60s,
+      # for a job total of 67s against 42-48s. The forcing below is exactly the
+      # cross-system evaluation that parallelises, so the trade is lopsided.
+      # docs.yml has the opposite shape and does use the fast installer.
       - uses: DeterminateSystems/nix-installer-action@v22
 
       # The registry check forces every system the flake advertises, not just

.github/workflows/docs.yml

@@ -40,7 +40,15 @@ jobs:
         with:
           python-version: "3.12"
 
-      - uses: DeterminateSystems/nix-installer-action@v22
+      # `nix eval` builds nothing at all, so this job has no use for a daemon or
+      # build users. Here the installer dominated: 23-26s to install against
+      # 8-9s of actual evaluation, more than half the job. The single-user
+      # installer unpacks in ~1s. It gives upstream Nix rather than Determinate
+      # Nix, so the manifest evaluation loses parallel eval and gets slower —
+      # but from 8-9s, which the install saving more than covers. check.yml and
+      # cachix.yml keep the Determinate installer, for different reasons; see
+      # the notes there.
+      - uses: nixbuild/nix-quick-install-action@v35
 
       # The registry publishes what it knows about itself here, so the
       # generator does not have to re-derive it by walking packages/*/data.json.