chore: flake update, CI cache and VM storage fixes

[systemstart]

Summary by CodeRabbit

• New Features
  • Container image storage now uses persistent disk-backed ext4 storage (via a sparse disk image) mounted at /var/lib/containers, improving runtime reliability.
  • CI/release workflows now use Cachix caching to speed up builds.
• Bug Fixes
  • Prevented container image unpack failures caused by permission/id-mapping limitations with virtiofs.
• Chores
  • Pinned the flake update workflow action to a stable release for more predictable updates.
• Documentation
  • Updated README with the rationale and new persistence setup for container storage.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR migrates CRI storage to an ext4-backed sparse image and updates the runner, module, and docs accordingly. It also adds Cachix/Nix installer workflow settings and pins the update-flake-lock action version.

Changes

CRI Storage Migration

Layer / File(s)	Summary
CRI volume module definition modules/cri.nix	Replaces virtiofs shares with an ext4-mounted /var/lib/containers volume backed by a sparse image.
VM runner script CRI image wiring flake.nix	Introduces CRI_IMG, removes virtiofsd startup/cleanup logic, and rewrites QEMU arguments for the persistent image with writeback caching.
Documentation update for storage behavior README.md	Describes the new ext4 image mount and the virtiofs ownership failure that motivated it.

CI/Release Workflow Updates

Layer / File(s)	Summary
Nix installer and Cachix cache configuration .github/workflows/ci.yml, .github/workflows/release.yml	Adds determinate: false, an empty diagnostic-endpoint, and a Cachix cache step using repository secrets; ci.yml also adds a blank line in the release job.
Pin update-flake-lock action version .github/workflows/update-flake.yml	Pins update-flake-lock to @v28 instead of @main.

Estimated code review effort: 3 (Moderate) | ~25 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main changes: flake update, CI caching, and VM storage fixes.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/update

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@flake.nix`:
- Line 111: The CRI storage backing file is currently placed inside $AGENT_DIR,
which is also exported into the guest by the agent-home virtiofs share. Move the
cri-storage.img path in the setup around the CRI_IMG assignment to a host-only
sibling/state directory outside the shared agent home, and update any related
README path references so the guest cannot see or modify the raw image.
- Line 231: The sed substitution that uses $CRI_IMG needs escaping before it is
inserted into the replacement text, since symbols like &, \, or | can corrupt
the generated command. Update the logic around the CRI image replacement in the
flake.nix sed command to sanitize the value of $CRI_IMG before passing it to
sed, so the runner command is built safely even when AGENT_DIR contains special
characters.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3a279de4-001c-4639-bb46-95c5aae10d78

📥 Commits

Reviewing files that changed from the base of the PR and between 9caa9b4 and a0c755f.

⛔ Files ignored due to path filters (1)

• flake.lock is excluded by !**/*.lock

📒 Files selected for processing (6)

• .github/workflows/ci.yml
• .github/workflows/release.yml
• .github/workflows/update-flake.yml
• README.md
• flake.nix
• modules/cri.nix