fix(release): add Nix package steps to release molecule (#1108)

* fix(release): add Nix package steps to release molecule

Add missing Nix support to the release workflow:
- bump-default-nix: Updates version in default.nix
- update-vendorhash: Prompts to update vendorHash if go.mod changed
- Add default.nix to verify-versions check

This was lost when bump-version.sh was replaced with the molecule
workflow in 39dbe90a. The original Nix support from c802f27f included
vendorHash detection in bump-version.sh, but that logic was not
migrated to the new workflow.

Fixes #1107

* fix(nix): update vendorHash for current go.mod

.beads/formulas/beads-release.formula.toml

@@ -453,10 +453,58 @@ grep 'Alpha (v' README.md
 ```
 """
 
+[[steps]]
+id = "bump-default-nix"
+title = "Bump version in default.nix"
+needs = ["bump-readme"]
+description = """
+Update the Nix package version.
+
+```bash
+# macOS
+sed -i '' 's/version = "[^"]*";/version = "{{version}}";/' default.nix
+
+# Linux
+sed -i 's/version = "[^"]*";/version = "{{version}}";/' default.nix
+```
+
+Verify:
+```bash
+grep 'version = ' default.nix
+```
+"""
+
+[[steps]]
+id = "update-vendorhash"
+title = "Update Nix vendorHash if needed"
+needs = ["bump-default-nix"]
+description = """
+Update vendorHash if go.mod/go.sum changed since last release.
+
+Check if update is needed:
+```bash
+# Compare go.mod/go.sum against last tag
+LAST_TAG=$(git describe --tags --abbrev=0)
+git diff $LAST_TAG -- go.mod go.sum
+```
+
+If there are changes, run the update script:
+```bash
+./scripts/update-nix-vendorhash.sh
+```
+
+The script auto-detects nix or Docker and updates the hash automatically.
+
+Verify:
+```bash
+grep 'vendorHash = ' default.nix
+```
+"""
+
 [[steps]]
 id = "stamp-changelog"
 title = "Stamp changelog with release date"
-needs = ["bump-readme"]
+needs = ["update-vendorhash"]
 description = """
 Add the release date to the [Unreleased] section header.
 
@@ -492,6 +540,7 @@ grep 'Version = ' cmd/bd/version.go
 jq -r '.version' .claude-plugin/plugin.json
 jq -r '.version' npm-package/package.json
 grep 'version = ' integrations/beads-mcp/pyproject.toml
+grep 'version = ' default.nix
 ```
 
 All should show {{version}}.

default.nix

@@ -9,7 +9,7 @@ pkgs.buildGoModule {
   subPackages = [ "cmd/bd" ];
   doCheck = false;
   # Go module dependencies hash - if build fails with hash mismatch, update with the "got:" value
-  vendorHash = "sha256-mn2nnJ0o5Z1G7gy8d6qwY44iJe9vEmr+Eqwhmwpq6kU=";
+  vendorHash = "sha256-YU+bRLVlWtHzJ1QPzcKJ70f+ynp8lMoIeFlm+29BNPE=";
 
   # Git is required for tests
   nativeBuildInputs = [ pkgs.git ];