b031f778

By: Tom Sydney Kerckhove <syd@cs-syd.eu>

Fill and read the NixCI cache from local builds

NixCI rebuilds from scratch what a contributor has already built, which
is most of what it charges us for: the same derivations are built here
first, they just never leave this machine.

The dev shell now points Nix at a post-build-hook that copies every
path it builds to the NixCI cache, and the flake substitutes from that
cache in return. Both directions only need a token in ~/.netrc, so no
system configuration is involved: Nix hands the daemon its own
netrc-file setting, and the hook, which runs as the daemon user, reads
the token through it.

The hook is the one from the NixCI documentation, plus a fallback: a
post-build-hook that fails fails the build it was called for, so a
machine with no token, or no network, has to keep building as before.