fix(nix): update stale npmDepsHash and auto-fix on all lockfile changes

Hash mismatch was hidden by continue-on-error. Now the Nix Build
workflow fails visibly, and fix-nix-hash runs on every push/PR that
touches the lockfile (not just Dependabot).

.github/workflows/fix-nix-hash.yml

@@ -1,6 +1,11 @@
 name: Fix Nix hash
 
 on:
+  push:
+    branches: [main]
+    paths:
+      - 'package.json'
+      - 'package-lock.json'
   pull_request:
     paths:
       - 'package.json'
@@ -12,11 +17,10 @@ permissions:
 jobs:
   fix-nix-hash:
     runs-on: ubuntu-latest
-    if: github.actor == 'dependabot[bot]'
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.head_ref }}
+          ref: ${{ github.head_ref || github.ref }}
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - uses: actions/setup-node@v4

.github/workflows/nix-build.yml

@@ -32,7 +32,7 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
-    continue-on-error: true
+    continue-on-error: false
     steps:
       - uses: actions/checkout@v4
 

nix/package.nix

@@ -42,7 +42,7 @@ buildNpmPackage rec {
 
   # To update: run `nix build` with lib.fakeHash, copy the `got:` hash.
   # CI auto-updates this when package-lock.json changes (see .github/workflows/).
-  npmDepsHash = "sha256-gOwvUBvem1SxDMypaexz6RaHRm2xFmUT9iwOW2ErEAM=";
+  npmDepsHash = "sha256-xj5pSRE/F8zvrOcVgc22bSHG4GTFzVHgB6eFSs+eI8Y=";
 
   # Prevent onnxruntime-node's install script from running during automatic
   # npm rebuild (it tries to download from api.nuget.org, which fails in the sandbox).