Use go2nix for the Nix build

[ryantm]

Why

Switching upm off buildGoModule lets Nix cache the Go package graph at a finer granularity and avoids regenerating the Python sqlite asset when only unrelated entrypoint code changes.

What changed

• added the upstream go2nix flake input, checked in a generated go2nix.toml, and exposed the pinned Nix binary and plugin needed to evaluate go2nix in this repo
• migrated the upm package from buildGoModule to goEnv.buildGoApplication, while keeping pypi_map.sqlite generation in a separate filtered derivation so it can stay cached across unrelated CLI rebuilds
• updated Semaphore to prebuild the matching Nix/plugin pair, seed GOMODCACHE, and run the package build with the go2nix evaluator settings

Test plan

• eval "$(nix print-dev-env)" && nix build .#go2nix-nix .#go2nix-nix-plugin --no-link >/dev/null && export GO2NIX_NIX="$(nix eval --raw .#go2nix-nix.outPath)/bin/nix" && export GO2NIX_PLUGIN="$(nix eval --raw .#go2nix-nix-plugin.outPath)/lib/nix/plugins/libgo2nix_plugin.so" && export GOMODCACHE="$(mktemp -d)" && go mod download >/dev/null && "$GO2NIX_NIX" build . --no-link --option allow-import-from-derivation true --option plugin-files "$GO2NIX_PLUGIN"
• benchmarked fresh worktrees with a full nix build before/after the change and a rebuild after a trivial cmd/upm/main.go edit:
  • before full build: 122.586s
  • before trivial edit rebuild: 85.181s
  • after full build: 67.798s
  • after trivial edit rebuild: 7.017s

Revertibility

Safe to revert. This only changes the Nix build graph and CI invocation, and does not touch persisted data, network protocols, or shipped package-manager behavior.

~ written by Zerg 👾