Fix pure eval and harden nix script bootstrap

scripts/codex-maintenance.sh

@@ -9,7 +9,22 @@ warn-dirty = false
 
 MODE="${1:-validate}"
 
-hosts_json="$(nix eval --json --no-accept-flake-config .#nixosConfigurations --apply builtins.attrNames)"
+ensure_nix_profile() {
+  if [ -f /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh ]; then
+    . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+  elif [ -f "$HOME/.nix-profile/etc/profile.d/nix.sh" ]; then
+    . "$HOME/.nix-profile/etc/profile.d/nix.sh"
+  fi
+}
+
+ensure_nix_profile
+
+if ! command -v nix >/dev/null 2>&1; then
+  echo "ERROR: nix is not available in PATH. Run bash scripts/codex-setup.sh first." >&2
+  exit 127
+fi
+
+hosts_json="$(nix eval --json --no-use-registries --no-accept-flake-config .#nixosConfigurations --apply builtins.attrNames)"
 hosts="$(echo "$hosts_json" | jq -r '.[]')"
 
 echo "Hosts:"
@@ -29,17 +44,17 @@ fi
 
 echo
 echo "Checking Nix formatting with nixpkgs-fmt..."
-nix run --no-accept-flake-config nixpkgs#nixpkgs-fmt -- --check .
+nix run --no-use-registries --no-accept-flake-config github:NixOS/nixpkgs/nixos-25.11#nixpkgs-fmt -- --check .
 
 echo
 echo "Running statix lint..."
-nix run --no-accept-flake-config nixpkgs#statix -- check .
+nix run --no-use-registries --no-accept-flake-config github:NixOS/nixpkgs/nixos-25.11#statix -- check .
 
 echo
 echo "Evaluating host toplevel derivations..."
 for host in $hosts; do
   echo "==> $host"
-  nix eval --raw --no-accept-flake-config ".#nixosConfigurations.${host}.config.system.build.toplevel.drvPath"
+  nix eval --raw --no-use-registries --no-accept-flake-config ".#nixosConfigurations.${host}.config.system.build.toplevel.drvPath"
 done
 
 if [[ "$MODE" == "dry-run" ]]; then
@@ -47,7 +62,7 @@ if [[ "$MODE" == "dry-run" ]]; then
   echo "Running dry-run builds for all hosts. This will not create result symlinks."
   for host in $hosts; do
     echo "==> Dry-run build: $host"
-    nix build --dry-run --no-link --no-accept-flake-config ".#nixosConfigurations.${host}.config.system.build.toplevel"
+    nix build --dry-run --no-link --no-use-registries --no-accept-flake-config ".#nixosConfigurations.${host}.config.system.build.toplevel"
   done
 fi