Nix container build for nettest (#214)

## Summary
- Add `containers/nettest/default.nix` using `dockerTools.buildLayeredImage` with curl, jq, dnsutils, cacert, and bash — equivalent to the existing Dockerfile
- Update `container-tag-and-release` to require `--nix` or `--dockerfile` flag when both build types exist for a container
- Update `container-list` to show `[dockerfile+nix]` label when both exist

## Deployment and Testing
- [ ] SSH to ringtail, run `nix build -f containers/nettest/default.nix -o result` to verify the nix expression builds
- [ ] Tag `nettest-nix-v1.0.0`, confirm `build-container-nix` workflow runs on `nix-container-builder` runner and pushes to registry
- [ ] Smoke test on ringtail k3s: `kubectl run nettest --image=registry.ops.eblu.me/blumeops/nettest:v1.0.0 --restart=Never && kubectl logs nettest`
- [ ] Verify `mise run container-list` shows `[dockerfile+nix]` for nettest
- [ ] Verify `mise run container-tag-and-release nettest v1.1.0` prompts for build type

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/214

mise-tasks/container-list

@@ -14,20 +14,26 @@ echo ""
 for dir in "$CONTAINER_DIR"/*/; do
     [[ -d "$dir" ]] || continue
 
-    # Determine build type
-    if [[ -f "$dir/default.nix" ]]; then
-        build_type="nix"
-    elif [[ -f "$dir/Dockerfile" ]]; then
-        build_type="dockerfile"
-    else
-        continue
-    fi
+    # Determine available build types
+    has_dockerfile=false
+    has_nix=false
+    [[ -f "$dir/Dockerfile" ]] && has_dockerfile=true
+    [[ -f "$dir/default.nix" ]] && has_nix=true
+
+    # Skip directories with no build files
+    $has_dockerfile || $has_nix || continue
+
+    # Build type label
+    types=()
+    $has_dockerfile && types+=("dockerfile")
+    $has_nix && types+=("nix")
+    label=$(IFS=+; echo "${types[*]}")
 
     # Extract container name from directory
     container=$(basename "$dir")
     image="blumeops/$container"
 
-    echo "[$build_type] $container"
+    echo "[$label] $container"
     echo "   Image: $REGISTRY/$image"
     echo "   Path: $dir"
 
@@ -49,5 +55,7 @@ echo "---"
 echo "To release a new version:"
 echo "  mise run container-tag-and-release <container> <version>"
 echo ""
+echo "One tag triggers all applicable workflows (dockerfile and/or nix)."
+echo ""
 echo "Example:"
 echo "  mise run container-tag-and-release nettest v1.0.0"