[codex] cache-warm: fail on Cachix 403

[andreadellacorte]

Make cache-warm fail hard when Cachix rejects an upload.

• replace the cachix JS action with an explicit cachix push invocation
• preserve the dev-shell build step, but make the upload step exit non-zero on auth errors
• addresses the soft-failing 403 we saw in cache-warm

The queued cache-warm (x86_64-darwin) job in run 26185117922 is still sitting on a macOS-13 runner slot; it can be cancelled if we do not need it anymore.

[ser-pounce]

Just want to check if this is intended as a draft, no problem if it is.

[andreadellacorte]

Hi there! It was draft but it's now OK to be reviewed (I can't convert it to ready)