Nix container build for nettest (#214)

## Summary
- Add `containers/nettest/default.nix` using `dockerTools.buildLayeredImage` with curl, jq, dnsutils, cacert, and bash — equivalent to the existing Dockerfile
- Update `container-tag-and-release` to require `--nix` or `--dockerfile` flag when both build types exist for a container
- Update `container-list` to show `[dockerfile+nix]` label when both exist

## Deployment and Testing
- [ ] SSH to ringtail, run `nix build -f containers/nettest/default.nix -o result` to verify the nix expression builds
- [ ] Tag `nettest-nix-v1.0.0`, confirm `build-container-nix` workflow runs on `nix-container-builder` runner and pushes to registry
- [ ] Smoke test on ringtail k3s: `kubectl run nettest --image=registry.ops.eblu.me/blumeops/nettest:v1.0.0 --restart=Never && kubectl logs nettest`
- [ ] Verify `mise run container-list` shows `[dockerfile+nix]` for nettest
- [ ] Verify `mise run container-tag-and-release nettest v1.1.0` prompts for build type

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/214

.forgejo/workflows/build-container-nix.yaml

@@ -1,17 +1,17 @@
 # Nix container build workflow
-# Triggers on tags matching: <container>-nix-v<version>
-# Builds from containers/<container>/default.nix using nix build
-# Pushes to Zot registry via skopeo
+# Triggers on tags matching: <container>-v<version>
+# Builds from containers/<container>/default.nix if it exists, skips otherwise
+# Pushes to Zot registry via skopeo with -nix image tag suffix
 #
 # Examples:
-#   nettest-nix-v1.0.0  -> builds containers/nettest/default.nix
-#   myapp-nix-v2.1.0    -> builds containers/myapp/default.nix
+#   nettest-v1.0.0  -> builds containers/nettest/default.nix, pushes :v1.0.0-nix
+#   devpi-v2.1.0    -> skips (no default.nix)
 name: Build Container (Nix)
 
 on:
   push:
     tags:
-      - '*-nix-v[0-9]*'
+      - '*-v[0-9]*'
 
 jobs:
   build:
@@ -23,10 +23,10 @@ jobs:
           TAG="${GITHUB_REF_NAME}"
           echo "Tag: $TAG"
 
-          # Extract container name (everything before -nix-v)
-          # e.g., "nettest-nix-v1.0.0" -> "nettest"
-          CONTAINER="${TAG%-nix-v[0-9]*}"
-          VERSION="${TAG#"${CONTAINER}"-nix-}"
+          # Extract container name (everything before -v)
+          # e.g., "nettest-v1.0.0" -> "nettest", "my-app-v2.0.0" -> "my-app"
+          CONTAINER="${TAG%-v[0-9]*}"
+          VERSION="${TAG#"${CONTAINER}"-}"
 
           echo "container=$CONTAINER" >> "$GITHUB_OUTPUT"
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
@@ -46,33 +46,29 @@ jobs:
             echo "Found $CONTEXT/default.nix"
             echo "exists=true" >> "$GITHUB_OUTPUT"
           else
-            echo "No default.nix found at $CONTEXT/default.nix"
+            echo "No default.nix found at $CONTEXT/default.nix — skipping"
             echo "exists=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Skip if container not found
-        if: steps.check.outputs.exists != 'true'
+      - name: Resolve nixpkgs
+        if: steps.check.outputs.exists == 'true'
+        id: nixpkgs
         run: |
-          echo "========================================"
-          echo "Nix container not found: ${{ steps.parse.outputs.container }}"
-          echo "========================================"
-          echo ""
-          echo "Tag '${{ github.ref_name }}' does not match any nix container in containers/"
-          echo ""
-          echo "Available nix containers:"
-          for nix in containers/*/default.nix; do
-            [ -f "$nix" ] && echo "  - $(basename "$(dirname "$nix")")"
-          done
-          echo ""
-          echo "Skipping build."
+          # Resolve nixpkgs from the flake registry for <nixpkgs> lookup
+          NIXPKGS_PATH=$(nix flake metadata nixpkgs --json | jq -r '.path')
+          echo "Resolved nixpkgs: $NIXPKGS_PATH"
+          echo "path=$NIXPKGS_PATH" >> "$GITHUB_OUTPUT"
 
       - name: Build with nix
         if: steps.check.outputs.exists == 'true'
         id: build
+        env:
+          NIX_PATH: "nixpkgs=${{ steps.nixpkgs.outputs.path }}"
         run: |
           CONTAINER="${{ steps.parse.outputs.container }}"
           echo "Building containers/$CONTAINER/default.nix"
-          nix build -f "containers/$CONTAINER/default.nix" -o result
+          echo "NIX_PATH=$NIX_PATH"
+          nix-build "containers/$CONTAINER/default.nix" -o result
           echo "Build complete: $(readlink result)"
 
       - name: Push to registry
@@ -80,7 +76,7 @@ jobs:
         run: |
           CONTAINER="${{ steps.parse.outputs.container }}"
           VERSION="${{ steps.parse.outputs.version }}"
-          IMAGE="registry.ops.eblu.me/blumeops/$CONTAINER:$VERSION"
+          IMAGE="registry.ops.eblu.me/blumeops/$CONTAINER:$VERSION-nix"
 
           echo "Pushing to $IMAGE"
           skopeo copy \

.forgejo/workflows/build-container.yaml

@@ -17,7 +17,6 @@ on:
 
 jobs:
   build:
-    if: "!contains(github.ref_name, '-nix-v')"
     runs-on: k8s
     steps:
       - name: Parse tag