Add native Nix CI builds for Linux and macOS

[nbareil]

Following #539, add native Nix package builds to CI on Linux x86_64 and Apple Silicon macOS. Each job enables sandboxing, verifies the runner's Nix system, and builds .#coop with the committed lock file, including workspace unit tests and installation checks.

Provide rsync and Nix-store tools for existing test fixtures, and select BSD utilities for the macOS ACL fixture. Two additional sudo-dependent tests are excluded only from the Linux Nix sandbox; ordinary Cargo CI continues to run them.

[hbrodin]

Thanks for contributing the Linux and macOS Nix CI checks. Could you add permissions: {} to the new nix job? The build uses public inputs and should not need the workflow’s inherited contents: read permission. Please confirm both matrix jobs still pass after the change.

I’m continuing to review the PR and will follow up if anything else comes up.