fix(ci): generate PR body before update-flake-lock action runs

[devinbhatt]

Summary

The update-flake-lock workflow failed on its most recent scheduled run with:

##[error]Input required and not supplied: contents

Root cause

The DeterminateSystems/update-flake-lock step set pr-body: ${{ steps.generate-body.outputs.body }}, but the generate-body step was defined after the action — so at the action's evaluation time the output didn't exist and pr-body resolved to an empty string. Internally the action pipes pr-body into DamianReeves/write-file-action's required contents input, which aborted the run.

A latent second bug: even if the steps were simply reordered, generate-body diffed git show HEAD:flake.lock against the on-disk file — but at that point both sides would be identical (nothing had run nix flake update yet), so the body would always be empty.

Fix

• Move generate-body before the action.
• Have generate-body snapshot the original flake.lock, run nix flake update itself, compute the jq diff against the snapshot, then restore the original lockfile so DeterminateSystems/update-flake-lock owns the actual commit and push.
• Even on a no-change run, the body retains the ## Updated inputs: header line, so write-file-action's contents requirement is satisfied (and in that case the action won't open a PR anyway).

Test plan

• YAML parses (python -c "import yaml; yaml.safe_load(...)")
• Ran the new jq query locally against a synthetic before/after lockfile pair — it emits the expected - <input>: \` → ``` lines for each changed input
• Verified the no-change case still emits a non-empty body
• Trigger the workflow via workflow_dispatch from the Actions tab and confirm a PR is opened with a populated "Updated inputs" body

---

Generated by Claude Code