ci(nix): make the bun.nix drift check blocking

The check added in #350 only echoed a message (with backticks that bash
executed as command substitution, mangling it) and never failed the job,
so a stale bun.nix would still pass CI. Fail fast right after the
regenerate step instead, with a GitHub error annotation and the diffstat.

.github/workflows/nix-build.yml

@@ -46,6 +46,14 @@ jobs:
       - name: Regenerate bun.nix from bun.lock
         run: nix run --accept-flake-config github:nix-community/bun2nix -- -o bun.nix
 
+      - name: Fail if committed bun.nix is out of date
+        run: |
+          if ! git diff --quiet -- bun.nix; then
+            echo '::error file=bun.nix::bun.nix is out of date! Run `nix run github:nix-community/bun2nix -- -o bun.nix` (requires Nix) and commit the result.'
+            git diff --stat -- bun.nix
+            exit 1
+          fi
+
       - name: Check flake
         run: nix flake check --accept-flake-config
 
@@ -55,9 +63,3 @@ jobs:
       - name: Build package
         if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
         run: nix build --print-build-logs --accept-flake-config
-
-      - name: Check for diffs
-        run: |
-          if ! git diff --quiet; then
-            echo "`bun.nix` is out of date! Run `nix run github:nix-community/bun2nix -- -o bun.nix` on a NixOS system to regenerate it!"
-          fi