feat(worker): devenv-capable sandbox — Nix + devenv (Phase C1)

[dcvz]

Summary

• Installs Nix (single-user, /nix owned by uid 10001) + devenv in the worker image so the non-root runtime user (cica, which Fargate selects via user: cica) can nix build and devenv shell a cloned repo — the prerequisite for opening verified PRs.
• /etc/nix/nix.conf enables flakes + the public binary caches (cache.nixos.org, devenv.cachix.org), so cold builds are downloads, not from-source. ENV HOME/PATH make nix+devenv work in the agent's non-login shells.
• The worker builds the devenv shell cold at runtime (deps pulled from public caches). Caching optimizations (private S3 cache, EFS warm store, baked closures) are deliberately deferred — this is Phase C1's minimal sandbox.
• This is C1 of Phase C (ticket→PR). C2 (repo access + per-repo AGENTS.md) and C3 (the ticket→PR flow) build on it.

Test Plan

• New CI step in docker-flow: scripts/test-devenv-sandbox.sh runs as uid 10001:10001 (mirrors Fargate) in the built image, realizes a Nix derivation (nix build nixpkgs#hello) and enters devenv shell -- hello → asserts Hello, world!. Locally: DEVENV SANDBOX OK.
• devenv version runs at image build time.
• Existing bun/cursor/claude-code/entrypoint behavior unchanged.
• Live sign-off (deferred, C2-gated): on a real Fargate worker, clone a Root devenv repo and run its tests via devenv shell.

Notes

• Image grows to ~2.4 GB (Nix + devenv base closure) — accepted for C1; Fargate-pull/caching is a C2 concern.
• Fixture pins nixpkgs-unstable without a lock (low-risk hello smoke); a committed devenv.lock for hermeticity is flagged for C2.

🤖 Generated with Claude Code