fix(maestro): write nix.conf before installing nix in CI

The runner container is root with no `nixbld` group. The installer
writes `build-users-group = nixbld` regardless and then fails on it:

  error: the group 'nixbld' specified in 'build-users-group' does not exist

Writing the config first (and again after, in case the installer
replaced it) clears that and enables flakes in the same place.

Refs #98

.gitea/workflows/ci.yml

@@ -106,11 +106,16 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # Single-user install: the runner is a container with no systemd, and
-      # the --daemon installer refuses without it.
+      # The runner container is root with no `nixbld` group, but the installer
+      # writes `build-users-group = nixbld` anyway and then fails on it, so the
+      # config goes in first. Flakes are off by default and `nix build .#…`
+      # needs them. Written again afterwards in case the installer replaced it.
       - name: Install nix
         run: |
+          mkdir -p /etc/nix
+          printf 'build-users-group =\nexperimental-features = nix-command flakes\n' > /etc/nix/nix.conf
           curl -fsSL https://nixos.org/nix/install | sh -s -- --no-daemon --yes
+          printf 'build-users-group =\nexperimental-features = nix-command flakes\n' > /etc/nix/nix.conf
           echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH"
 
       # The installer does not enable flakes, so `nix build .#…` needs the