feat: enable full-scale Nix evaluation in sandboxed environment

- Refactor nixec crate from monolithic main function to more modular code
- Implement complete sandboxed nix-instantiate execution using birdcage
- Add public run_nixec() function for testing and external usage
- Update birdcage to git version with fixing nix call `unshare(CLONE_FS)`
- Add anyhow dependency and improve error handling
- Extract hardcoded paths to constants for maintainability
- Update build system and development environment dependencies

Author: nrdxp

Cargo.lock

@@ -13,7 +13,7 @@ version = "0.3.0"
 [profile.release]
 codegen-units = 1
 lto           = true
-opt-level     = 3
+opt-level     = "z"
 strip         = true
 
 [dependencies]
@@ -83,6 +83,7 @@ prodash = { version = "30.0.1", features = [
 ] }
 
 [patch.crates-io]
+birdcage           = { git = "https://github.com/nrdxp/birdcage", branch = "clone_fs" }
 tracing            = { git = "https://github.com/nrdxp/tracing", branch = "hierarchical" }
 tracing-appender   = { git = "https://github.com/nrdxp/tracing", branch = "hierarchical" }
 tracing-core       = { git = "https://github.com/nrdxp/tracing", branch = "hierarchical" }

Cargo.toml

@@ -15213,6 +15213,10 @@ rec {
         ];
         src = lib.cleanSourceWith { filter = sourceFilter;  src = ../crates/nixec; };
         dependencies = [
+          {
+            name = "anyhow";
+            packageId = "anyhow";
+          }
           {
             name = "birdcage";
             packageId = "birdcage";
@@ -18761,9 +18765,9 @@ rec {
       };
       "rustls" = rec {
         crateName = "rustls";
-        version = "0.23.14";
+        version = "0.23.35";
         edition = "2021";
-        sha256 = "1a0b2sdvq69vqrz08wvjmlqafzh7pfgzhn9j0n107f9wd529jpa1";
+        sha256 = "13xxk2qqchibd7pr0laqq6pzayx9xm4rb45d8rz68kvxday58gsk";
         dependencies = [
           {
             name = "log";
@@ -18812,13 +18816,14 @@ rec {
         ];
         features = {
           "aws-lc-rs" = [ "aws_lc_rs" ];
-          "aws_lc_rs" = [ "dep:aws-lc-rs" "webpki/aws_lc_rs" ];
+          "aws_lc_rs" = [ "dep:aws-lc-rs" "webpki/aws-lc-rs" "aws-lc-rs/aws-lc-sys" "aws-lc-rs/prebuilt-nasm" ];
           "brotli" = [ "dep:brotli" "dep:brotli-decompressor" "std" ];
-          "default" = [ "aws_lc_rs" "logging" "std" "tls12" ];
-          "fips" = [ "aws_lc_rs" "aws-lc-rs?/fips" ];
+          "default" = [ "aws_lc_rs" "logging" "prefer-post-quantum" "std" "tls12" ];
+          "fips" = [ "aws_lc_rs" "aws-lc-rs?/fips" "webpki/aws-lc-rs-fips" ];
           "hashbrown" = [ "dep:hashbrown" ];
           "log" = [ "dep:log" ];
           "logging" = [ "log" ];
+          "prefer-post-quantum" = [ "aws_lc_rs" ];
           "read_buf" = [ "rustversion" "std" ];
           "ring" = [ "dep:ring" "webpki/ring" ];
           "rustversion" = [ "dep:rustversion" ];
@@ -18882,11 +18887,19 @@ rec {
       };
       "rustls-pki-types" = rec {
         crateName = "rustls-pki-types";
-        version = "1.9.0";
+        version = "1.13.0";
         edition = "2021";
-        sha256 = "0mcc901b4hm2ql2qwpf2gzqhqn6d7iag92hr872wjr8c6wsnws8f";
+        sha256 = "0yjzsnpv1sjbnfxbbmrnyimd23jip48nav6l9hr1rjd06vcjl64l";
         libName = "rustls_pki_types";
+        dependencies = [
+          {
+            name = "zeroize";
+            packageId = "zeroize";
+            optional = true;
+          }
+        ];
         features = {
+          "alloc" = [ "dep:zeroize" ];
           "default" = [ "alloc" ];
           "std" = [ "alloc" ];
           "web" = [ "web-time" ];
@@ -18896,9 +18909,9 @@ rec {
       };
       "rustls-webpki" = rec {
         crateName = "rustls-webpki";
-        version = "0.102.8";
+        version = "0.103.8";
         edition = "2021";
-        sha256 = "1sdy8ks86b7jpabpnb2px2s7f1sq8v0nqf6fnlvwzm4vfk41pjk4";
+        sha256 = "0lpymb84bi5d2pm017n39nbiaa5cd046hgz06ir29ql6a8pzmz9g";
         libName = "webpki";
         dependencies = [
           {
@@ -18920,8 +18933,10 @@ rec {
         ];
         features = {
           "alloc" = [ "ring?/alloc" "pki-types/alloc" ];
-          "aws_lc_rs" = [ "dep:aws-lc-rs" ];
-          "default" = [ "std" "ring" ];
+          "aws-lc-rs" = [ "dep:aws-lc-rs" "aws-lc-rs/aws-lc-sys" "aws-lc-rs/prebuilt-nasm" ];
+          "aws-lc-rs-fips" = [ "dep:aws-lc-rs" "aws-lc-rs/fips" ];
+          "aws-lc-rs-unstable" = [ "aws-lc-rs" "aws-lc-rs/unstable" ];
+          "default" = [ "std" ];
           "ring" = [ "dep:ring" ];
           "std" = [ "alloc" "pki-types/std" ];
         };

build/Cargo.nix

@@ -6,4 +6,5 @@ version = "0.1.0"
 [dependencies]
 birdcage = "^0.8"
 
+anyhow.workspace    = true
 thiserror.workspace = true