cb6d94e2

By: Michael Lynch <git@mtlynch.io>

Test Dockerfile as impure NixCI job

Replace the pure docker-image derivation with a runnable wrapper that NixCI can execute as an impure test. The test runs Kaniko against the real Dockerfile from an in-repository checkout, so registry pulls, Go module downloads, and apk installs happen outside the pure Nix build sandbox.