You've made some significant assumptions, one of those assumptions is that the brute force way is the most efficient way or put another way there is no optimal way to calculate collisions better than brute force.
That line of thinking is very flawed. Has shown to be flawed many times in the past several decades, and shouldn't even be up for debate given the evidence and deprecation of various cryptographic functions (as vulnerabilities become known publicly). We all know vulnerabilities were known before the deprecation because detection is a lagging process.
Also note, as far as the respondents of the project I've spoken with have said, they do not even check for existing collisions. So if a collision did occur, you wouldn't even know it without specialized knowledge.
You can never have something compromised injected onto your computer this way either because nix requires signed builds to download from a remote repository. If you trust a malicious repository... that's on you. By default, only nixpkgs is trusted with the default hydra.
As a thought experiment, say a collision is found for libc or the standard library, thanks to all that research on primes that's been released recently, assume a more efficient search is found.
What would the failure domains be for those two libraries if, a) the library was non-functional suddenly, or b) the library remained functional but malicious.
Would Nix detect the collision, or would Nix simply recreate the dependency graph overwriting the old but secure with this new malicious software.
Almost all of the security primitives are implemented at domain edges, which means local access, or remote exploitation would have equal effect, and a watering hole/supply chain attack may not even be necessary.
I really don't get your point.
That's just trolling. Primes have nothing to do with sha256 beyond the initial value. It's just bitwise operations and additions.
Barring a catastrophic break, there will never be a collision witnessed across the full lifespan of humanity.