feat(nix): maintain a stable release branch

[jleni]

Summary

Nix examples currently omit a ref, so users follow unreleased main on every flake update.

• maintain a moving stable branch that accepts only GitHub's latest GA semver tag
• wait for the gated release asset upload, recheck latest at the write boundary, and update with fast-forward plus compare-and-swap protection
• point the Nix installation examples at github:kunobi-ninja/kache/stable

Bootstrap

Merging this PR triggers a one-time bootstrap to the current latest stable release, v0.14.2 (cab82577a37b4f26df40771f8e6de12cc5db67fd). Its release-upload CI is green. Later GA releases advance the branch; RC, stale, or divergent updates leave it unchanged or fail closed.

Validation

• stable-branch git regression: RC rejection, initial creation, stale event, GA advance, idempotence, divergent-ref protection
• shellcheck and bash -n
• focused pinned-action verification
• release version and AUR pkgver checks
• workflow YAML parse and git diff --check

Closes #756