[anneal][v2] Stabilize Nix omnibus archive builds

.github/workflows/anneal.yml

@@ -241,7 +241,7 @@ jobs:
         uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: anneal/v2/target/nix-cache-main
-          key: anneal-v2-main-nix-cache-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('anneal/v2/flake.nix', 'anneal/v2/flake.lock', 'anneal/v2/rewrite-lake-vendor.py') }}
+          key: anneal-v2-main-nix-cache-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('anneal/v2/flake.nix', 'anneal/v2/flake.lock', 'anneal/v2/rewrite-lake-vendor.py', 'anneal/v2/prune-lake-cache.py') }}
 
       # Pull request caches are scoped by GitHub to the PR merge ref, so they
       # can speed up repeated pushes to the same PR without becoming visible to
@@ -253,7 +253,7 @@ jobs:
         uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: anneal/v2/target/nix-cache-pr
-          key: anneal-v2-pr-nix-cache-v1-${{ runner.os }}-${{ runner.arch }}-pr-${{ github.event.pull_request.number }}-${{ hashFiles('anneal/v2/flake.nix', 'anneal/v2/flake.lock', 'anneal/v2/rewrite-lake-vendor.py') }}
+          key: anneal-v2-pr-nix-cache-v1-${{ runner.os }}-${{ runner.arch }}-pr-${{ github.event.pull_request.number }}-${{ hashFiles('anneal/v2/flake.nix', 'anneal/v2/flake.lock', 'anneal/v2/rewrite-lake-vendor.py', 'anneal/v2/prune-lake-cache.py') }}
 
       - name: Install Nix
         uses: DeterminateSystems/determinate-nix-action@441b9e401ac050c38a07d8313748c5c2d17e8aff # v3.6.1

anneal/v2/check-flake-eval.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+#
+# Copyright 2026 The Fuchsia Authors
+#
+# Licensed under a BSD-style license <LICENSE-BSD>, Apache License, Version 2.0
+# <LICENSE-APACHE or https://www.apache.org/licenses/LICENSE-2.0>, or the MIT
+# license <LICENSE-MIT or https://opensource.org/licenses/MIT>, at your option.
+# This file may not be copied, modified, or distributed except according to
+# those terms.
+
+set -euo pipefail
+
+ROOT="$(git rev-parse --show-toplevel)"
+FLAKE="$ROOT/anneal/v2"
+
+systems=(
+  aarch64-darwin
+  aarch64-linux
+  x86_64-darwin
+  x86_64-linux
+)
+
+packages=(
+  aeneas-compiled
+  aeneas-download
+  aeneas-metadata-files
+  aeneas-unpacked
+  default
+  leantar
+  lean-toolchain
+  mathlib-cache-download
+  mathlib-cache-unpacked
+  omnibus-archive
+  omnibus-archive-ci
+  omnibus-archive-layout-check
+  omnibus-tar
+  rust-toolchain
+)
+
+for system in "${systems[@]}"; do
+  for package in "${packages[@]}"; do
+    printf 'Evaluating packages.%s.%s...\n' "$system" "$package"
+    nix eval --raw "$FLAKE#packages.$system.$package.drvPath" >/dev/null
+  done
+done
+
+# `test-ifd` intentionally reads metadata from the output of a derivation to
+# verify that Aeneas metadata can drive downstream derivations. A fresh CI
+# runner cannot evaluate that attribute under `--no-build` unless the
+# intermediate derivation is already valid in the local Nix store, so this
+# lightweight PR check explicitly covers the release-relevant package graph
+# above and leaves `test-ifd` to explicit local/Nix testing.