fix(nix): auto-generate config keys from Python, remove manual config-keys.json

[alt-glitch]

What does this PR do?

Removes nix/config_keys.json as well as config drift check.
Uses a nix derivation to pull in the default config.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• nix/checks.nix — Added configKeys derivation in the let block that auto-generates config leaf keys from Python's DEFAULT_CONFIG at build time. Exposed as packages.configKeys. Removed the config-drift check (lines 104-159) that compared against a static reference file. Added set -euo pipefail and uses $TMPDIR instead of mktemp -d.
• nix/config-keys.json — Deleted. Static reference file that required manual updates whenever DEFAULT_CONFIG changed.
• website/docs/getting-started/nix-setup.md — Updated the "Discovering available config keys" tip to reference nix build .#configKeys && cat result instead of the deleted file. Removed config-drift from the individual checks list (line 610) and the checks table (line 624).

How to Test

1. nix flake check --print-build-logs — all 6 remaining checks pass (package-contents, entry-points-sync, cli-commands, bundled-skills, managed-guard, config-roundtrip with 7 scenarios)

2. nix build .#configKeys && cat result — outputs a sorted JSON array of leaf keys extracted from DEFAULT_CONFIG

3. nix flake show — configKeys appears under packages.x86_64-linux

4. Add a new key to DEFAULT_CONFIG in hermes_cli/config.py — nix build .#configKeys picks it up automatically without any manual file updates (the whole point of this change)

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform:

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A