fix(nix): validate leaf workspaces in flake sync check

[Sebastianhayashi]

Related Issue

No linked issue — this is a focused CI/build validation bug already documented in AGENTS.md.

Problem

pnpm-workspace.yaml is the source of truth for workspace membership, while flake.nix maintains matching hardcoded workspacePaths and workspaceNames lists.

scripts/check-nix-workspace.mjs currently validates only the transitive workspace dependency closure of @moonshot-ai/kimi-code. A leaf workspace that is not referenced by the CLI can therefore be omitted from flake.nix while the workspace-sync check still exits successfully.

That false green can leave workspace files out of the Nix source set or leave pnpmConfigHook without the workspace dependency metadata it needs.

What changed

• Validate every named workspace discovered from pnpm-workspace.yaml, rather than only the CLI dependency closure.
• Add a black-box regression test with an unreferenced leaf workspace omitted from flake.nix.
• Update the Nix workflow comment and repository maintenance guidance to describe the expanded check.

The existing workspace discovery, flake.nix parsing, error format, and success/failure exit codes remain unchanged.

This intentionally checks for pnpm workspaces missing from flake.nix; it does not reject stale extra entries that exist only in flake.nix.

Verification

• pnpm -C apps/kimi-code exec vitest run test/scripts/check-nix-workspace.test.ts (fails on the old implementation with result.status 0 instead of 1; passes after the fix)
• node scripts/check-nix-workspace.mjs (✅ All 23 workspace packages are present in flake.nix.)
• pnpm lint (0 errors)
• pnpm typecheck
• pnpm test — 2 pre-existing failures in packages/kosong/test/e2e/google-genai-adapter.test.ts and google-genai-error-mapping.test.ts; both reproduce identically on a clean upstream/main checkout and are unrelated to this diff. All other tests pass (15247 passed).
• git diff --check

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue, or explained the problem above.
• I have added tests that prove the fix works.
• Ran gen-changesets, or this PR needs no changeset.
• Ran gen-docs, or this PR needs no user-facing documentation update.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2da5a17

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR