Set nix options through NIX_CONFIG in CI

The runner mounts a persistent nix-store volume over /nix, and the
nixos/nix image makes /etc/nix/nix.conf a symlink into /nix/store. When
the volume and image versions differ, the link dangles and appending to
it fails before checkout. That broke asxpio and datacenterbingo CI on
2026-10-18.

Pass the settings in NIX_CONFIG instead, with build-users-group empty
and the sandbox off as the image config has them.

Assisted-by: Claude:opus-5-5

.forgejo/workflows/deploy.yaml

@@ -10,10 +10,17 @@ jobs:
   # build blocks deploy — Forgejo has no cross-workflow needs.
   check:
     runs-on: nix-latest
+    # Settings via env, not /etc/nix/nix.conf: in the image that is a
+    # symlink into /nix/store, which the runner's nix-store volume
+    # shadows, so it dangles once the image moves on.
+    env:
+      NIX_CONFIG: |
+        experimental-features = nix-command flakes
+        build-users-group =
+        sandbox = false
     steps:
       - name: Prepare container for actions
         run: |
-          echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf
           nix-env -iA nixpkgs.nodejs_22
 
       - name: Checkout

.forgejo/workflows/test.yaml

@@ -8,10 +8,17 @@ on:
 jobs:
   check:
     runs-on: nix-latest
+    # Settings via env, not /etc/nix/nix.conf: in the image that is a
+    # symlink into /nix/store, which the runner's nix-store volume
+    # shadows, so it dangles once the image moves on.
+    env:
+      NIX_CONFIG: |
+        experimental-features = nix-command flakes
+        build-users-group =
+        sandbox = false
     steps:
       - name: Prepare container for actions
         run: |
-          echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf
           nix-env -iA nixpkgs.nodejs_22
 
       - name: Checkout