fix(cachix): fetch public signing keys for pull caches again - #3178

What happened

While tracing why cachix.pull had no effect on our multi-user Macs (#3175), we checked what devenv would hand the daemon once the substituters did get through, and found the key list is always empty. CachixIntegration::init only reads known_keys from $XDG_DATA_HOME/devenv/cachix_trusted_keys.json, and nothing in 2.x writes that file: on a machine that has only ever run 2.x, ~/.local/share/devenv/ contains just gc/. CacheMetadata (publicSigningKeys) in devenv-core has no consumer and there is no request to the Cachix API anywhere in the repo. Up to v1.11, devenv/src/nix.rs fetched https://cachix.org/api/v1/cache/<name>, stored the keys in that file and passed them as --option extra-trusted-public-keys; the fetch was lost in the 2.0 rewrite. Issue: #3176.

Who else hits this

Everyone on 2.x, for every cachix.pull cache whose key is not already in nix.conf. Nix refuses paths signed by an unknown key (ignoring substitute for '...' as it's not signed by any of the keys in 'trusted-public-keys') and builds them instead. On multi-user installs this is currently masked by #3175, and becomes the blocker as soon as that is fixed. On single-user installs, whose in-process Worker does use the runtime substituter list, the missing key is already the reason paths from a cachix.pull cache get built today.

Change

Restore the fetch in CachixIntegration::init, mirroring 1.x: for each pull cache missing from the cached map, GET https://cachix.org/api/v1/cache/<name> with the resolved auth token as bearer (so private caches work), merge and persist to cachix_trusted_keys.json, then build the store settings as before. A cache that does not exist or needs a token is reported as a warning in the "Configuring cachix" activity and skipped, so one bad cache does not cost the others their keys. Fetches run concurrently with a 15s timeout.

Adds reqwest to the devenv crate (already a workspace dependency); Cargo.lock and Cargo.nix regenerated.

Test plan

• cargo fmt --check, cargo check -p devenv, cargo build -p devenv in the dev shell (aarch64-darwin). cargo clippy reports only a pre-existing lint in devenv-core/src/cachix.rs, untouched here.
• End to end with the built binary and an empty DEVENV_HOME: devenv eval cachix.pull in a project with the default pull list produced cachix_trusted_keys.json containing "devenv": "devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw=".
• New tests/cachix-public-keys asserts the same from a fresh DEVENV_HOME.
• CI

Fixes #3176.

🤖 Generated with Claude Code