perf(eval): cut nix-daemon round-trips during evaluation

[DerDennisOP]

Cold flake evaluation is dominated by per-derivation nix-daemon IPC. Each .drv instantiation fires many small synchronous round-trips wopAddTempRoot (op 11) per input path and wopAddToStore (op 7) per builder script, serialized on one daemon socket per eval-worker and on the daemon's global store-DB lock (seen via strace: op 11 / op 7 ↔ STDERR_LAST).

This is the per-commit lever: the eval-cache is keyed by the whole-flake fingerprint, so a normal CI commit is a cache miss and re-evaluates cold every time. Parallel sharding has landed; the remaining cold-eval cost is these round-trips.

Why the daemon

The eval-worker opens the default (auto) store, which resolves to the daemon for a non-root worker. The .drv registration writes /nix/var/nix/db/db.sqlite either way; the daemon path just adds the IPC round-trip on top of that unavoidable write.

Constraints found

• A direct/local store cannot safely share the daemon's db.sqlite while the daemon is live (concurrent writers, same WAL-contention class).
• An eval-store (a separate, worker-owned store for .drv) avoids the daemon and writes locally without root, but .drv then land under the eval-store root: the closure-walk drv_reader must read from there, and the .drv must be copied into the main store before build. Needs eval-store wiring in nix-bindings / the fork.

Options

1. Eval-store at a worker-writable path (no root) + drv_reader path handling + copy-to-main before build.
2. Run the eval-worker with direct store access (root / store owner) so auto resolves to a local store (conflicts with a running daemon).
3. Measure first: strace -c an eval-worker to confirm daemon read/write dominates vs CPU forcing (use statistics_json).

Acceptance

Cold eval no longer bottlenecks on serialized daemon IPC; show before/after wall-time and syscall counts.

Deferred from the parallel-eval / eval-cache-deadlock work. Related: #386 (optimized evaluations).

maybe save the new derivations to memory store

[DerDennisOP]

Measured with strace (option 3). Cold eval is ~100% nix-daemon IPC, not CPU forcing.

• 48,708 of 48,709 writes go to the daemon socket (the 1 other is stderr). ~22k wopAddTempRoot (op 11) + ~22k wopIsValidPath (op 1), interleaved 1:1, each a synchronous write plus a 16-byte STDERR_LAST read (pure round-trip framing, no payload).
• 99% of those hot ops are on .drv paths (input derivations). wopAddToStore (op 7) is only ~2.2k.
• Control: re-instantiating the same 10 drvs against a no-daemon local store gives 0 daemon socket I/O.

So the bottleneck is per-input-path daemon round-trips serialized on the daemon's global store-DB lock, as suspected, and it is overwhelmingly .drv traffic.

Direction (no eval-store, no root): a per-worker Rust shim speaking the worker protocol (harmonia daemon server) that the eval-worker opens via unix://. It answers IsValidPath(.drv) from an fs-stat and AddTempRoot(.drv) as a no-op, forwarding everything else (sources, queries, writes) to the real daemon. That drops ~99% of the hot daemon ops and the lock contention without an eval-store; resolved .drv land on disk via the forwarded writes and stay protected by the existing gcroots + cache-upload path.