Post the environment package diff as a comment on flake.lock update PRs

[jcardozo-eth]

Motivation

A Dependabot nix-group PR renders as a three-line revision/hash change in flake.lock while standing for hundreds of upstream nixpkgs commits (e.g. PR #5: 573 commits behind one hash bump). The flake.lock pin defines the whole toolchain environment that contributors and every CI job enter, yet today nothing in the PR shows which packages of that environment actually change. CI proves the environment still builds; the answer to "what changed" currently requires a local checkout and manual Nix commands, so in practice these PRs are merged blind.

Goal

Every PR touching flake.lock carries one automatically maintained comment with the package/version deltas of the pinned environment between base and head (nix store diff-closures output), so the operational question is answered in the PR itself: no local checkout, no AI, no manual steps.

Acceptance criteria

• A PR modifying flake.lock gets exactly one bot comment with the closure diff; later pushes update that same comment (identified as the workflow's own previous comment), never a second one.
• The comment reflects the exact realized closure of the environment: both sides are built (in practice mostly binary-cache downloads) and their output closures diffed, so the comment lists only packages that are actually in the environment.
• Works on Dependabot-authored PRs: the workflow's explicit permissions key restores pull-requests: write (Dependabot runs default to a read-only token), and no repository secrets are used.
• When the environment is unchanged (same output store path on both sides), no comment is posted; an existing comment from an earlier push is updated to say so.
• The workflow triggers only on PRs touching flake.lock or the workflow file itself.

Documentation

• CONTRIBUTING.md: the CI description gains a short paragraph on the workflow.

Delivery

• One PR: the workflow plus the CONTRIBUTING.md paragraph.
• Plan and log bookkeeping ride the same change (plan item, revision row, log entry).
• Verification on the open Dependabot PR build(deps): bump nixpkgs from 0ad6f47 to 8eeec93 in the nix group across 1 directory #5: comment @dependabot rebase; the synchronize event fires the new workflow and the diff comment appears; a further rebase updates the same comment in place.