Replace production rendering pipeline with nix build flow.

[shielded-nate]

The goal of this PR is to replace the production rendering pipeline to use nix build.

Motivation: As a nix-supremacy conspirator, I view all software as on a continuum where the desired end-point is that it is packaged so that nix build with the default target gives me everything I'd ever want to automatically derive about that software package, without needing to know anything about how that derivation happens (so passing commands/args to nix develop --command fails to meet the extreme of this continuum). The other end of the continuum is "not yet packaged sufficiently in nix", which is just a transient state our future selves will call the dark ages of software supply chains.

The only kind of snag I'm aware of that may exist is if the nix develop --command ... rendering is doing something funky with caching or non-explicit config via /tmp/dev-profile.

blocked by #1300

[daira]

There are some rendering regressions caused by the Nix build of the spec (actually by the fact that it pins TeXLive 2025, rather than anything else). They will be fixed incidentally in the Ironwood protocol spec PR (#1300, when it is out of draft), so please don't merge this before that.