This change introduces a Docker container shim which spawns the Nix
daemon after bind mounting all the relevant paths into the container.
The image is actually completely empty, other than metadata about what
to run.
This is a cheap and cheerful way to get decent process supervision in
environments that don't bring systemd, but do have docker ... which
is most everywhere in the GHA ecosystem.
It is special in that it doesn't have systemd, and it'd be great to
support Namespace.so. It is also a good test case for a variety
of self-hosted GHA runner use cases.
