orion: put sift CLI on PATH

The unit package is not in systemPackages, so `sift keys` is only
reachable via the store path. Track services.sift.package so it
follows the pin. Lands on the next orion switch.

hw/orion/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, inputs, ... }:
+{ pkgs, inputs, config, ... }:
 {
   imports = [
     ./hardware-configuration.nix
@@ -107,5 +107,8 @@
         };
       };
     };
+
+    # CLI (`sift keys`) tracks the same pin as the unit.
+    environment.systemPackages = [ config.services.sift.package ];
   };
 }