The deploy model now builds the image on Ubuntu 26.04 LTS, pinned by digest
and moved to the next LTS release when that ships, with Nix and nixpkgs
installed. nixpkgs is fixed at one commit of `nixos-26.05`, so an app built on
the same image gets the same packages each time. The example Dockerfiles
install a package with `nix-env -iA nixpkgs.git` and create the app's user
with `useradd`. Nix and runit come from Ubuntu's own packages, `runsvinit` is
built from its source, and every `run` script is bash with
`set -euo pipefail`.
Model: opus-5-5
sneak