feat(build): add Nix-native Linux toolchains

[SDAChess]

Goal

This PR introduces Nix-managed Linux toolchains that aim to replace cargo-zigbuild for release builds.

The existing cargo-zigbuild CI workflows remain in place for now. These development shells establish and validate the replacement toolchains before CI is migrated.

Toolchains

Two Linux development shells are added:

• glibc-2-28 builds dynamically linked GNU binaries compatible with glibc 2.28.
• musl uses musl-native Rust, Cargo, and C toolchains to produce static PIE binaries.

Both environments support plain Cargo commands without target-specific linker configuration.

System dependencies

Another goal is to vendor external system dependencies through Nix, especially native dependencies that are expensive to compile.

Z3 and AWS-LC are built as static Nix packages and discovered by their Rust -sys crates instead of being rebuilt from bundled sources by Cargo. This allows those builds to be cached and reused while keeping incremental Cargo builds focused on Rust code.

Additional native dependencies can follow the same pattern where it provides a meaningful build-time improvement.

Link performance

Both toolchains use mold.

OpenShell has a large dependency graph and produces many binaries, test executables, proc-macro shared objects, and other linked artifacts. Link time therefore represents a significant portion of clean builds and development iterations. Using mold keeps these linker-heavy workloads practical without requiring Cargo-specific linker wrappers or flags.

Validation

• Built OpenShell binaries in both development shells.
• Ran the workspace tests with the both toolchains.
• Verified the glibc binary’s required symbol versions and runtime dependencies.
• Verified that musl binaries are static PIE executables with no ELF interpreter or shared-library dependencies.
• Verified through the ELF .comment section that mold performed the links.