CI: refactor pass, simplify, update, make more robust

[colemickens]

I've already updated the GitHub repo to correspond to the new secret key name.

I don't want this reaching into my local cachix config, that was an odd dependency.

And now I've added another commit that will let the build job upload to cachix, meaning I can run updates locally, revert whatever I need to, push it to github and let the Action push to Cachix.

Theoretically I can now delete the nixpkgs-wayland cachix key, which ideally I would've done sometime ago.

closes #353

[colemickens]

to check myself aloud in a way:

[colemickens]

I sanity checked and fixed it up by pushing to a branch here. I've since deleted it. Feel free to review it or I'll merge it in a day or two.

This should theoretically help with some cache hits for users that update nixos-unstable frequently, by enabling the advance job that will try to advance nixpkgs + build + cache without necessarily trying to update the packages.

[colemickens]

Oh this also slims down the shell deps pulled in, though I think nix-build-uncached is still hauling in its own copy of nix.