Registry resolution algorithm is order-dependent, and to get the desired
behavior with nixpkgs the indirect entry to `github:nixos/nixpkgs`
should come after all other exact entries.
Additionally, ensure the latest contents of `flake-registry.json` are
used when running `ci.sh`. Without `--tarball-ttl 0`, old contents can
be reused across multiple runs. This shouldn't be an issue in CI, but
it's helpful when running `ci.sh` manually, during development.