Cachix cache signing keys are no longer fetched (regression since 2.0) #3176

Summary

Since 2.0, devenv no longer fetches the public signing keys of the caches in cachix.pull, so extra-trusted-public-keys is always empty and Nix cannot verify paths served by those caches.

Details

• CachixIntegration::init (devenv/src/devenv/cachix.rs) builds known_keys from load_known_keys(&paths.trusted_keys), i.e. $XDG_DATA_HOME/devenv/cachix_trusted_keys.json.
• Nothing writes that file any more. CacheMetadata (publicSigningKeys) in devenv-core/src/cachix.rs has no consumer, and the repo has no request to https://cachix.org/api/v1/cache/<name>. On a machine that has only ever run 2.x the file does not exist.
• get_nix_settings therefore emits an empty extra-trusted-public-keys, and add_trusted_public_keys is a no-op.
• Up to v1.11, devenv/src/nix.rs fetched https://cachix.org/api/v1/cache/<name> (with CACHIX_AUTH_TOKEN as bearer auth when set), stored publicSigningKeys in cachix_trusted_keys.json, and passed them as --option extra-trusted-public-keys.

Effect

For any cache whose key is not already in nix.conf, PathSubstitutionGoal rejects its paths with ignoring substitute for '...' as it's not signed by any of the keys in 'trusted-public-keys' and builds from source. Today this is masked on multi-user installs by the substituters never reaching the daemon at all (separate issue), but it becomes the blocker once that is fixed, and it already affects single-user installs.

Proposed fix

Restore the key fetch in CachixIntegration::init: for each pull cache missing from known_keys, GET https://cachix.org/api/v1/cache/<name> with the resolved auth token as bearer when available, persist the keys to cachix_trusted_keys.json, and warn (not fail) when a cache does not exist or requires a token. PR to follow.