nix_backend: set umask around nix ops - #2757

…#480)

## Summary

Move the devenv image's `NIXPKGS_REV` to `nixos-26.05`
(`0d9e9b832d03ac387417e16ce1febf73b2e631e1`), which ships devenv 2.1.2,
and bump `VERSION` to `2.0.0` because the devenv major is part of the
image contract. The README records that contract and what a 2.x CLI
changes for repos still locked to 1.x modules. Existing consumers keep
the immutable `1.0.0` tag.

## Eligibility & Accountability

- [x] I am a **federal employee or contractor** (PRs merge with
`@GSA-TTS/agentic-coding-team` code-owner approval; eligibility is
attested here, not authenticated). *Anyone may open issues without
this.*
- [x] **I understand this change and can explain it in my own words** —
I am the author of record and accountable for it.
- [x] By opening this PR, I **attest I have the right to release this
work** under the repository's [CC0-1.0](../LICENSE) dedication.

## AI Assistance Disclosure

- [x] AI tools were used in this contribution
- [x] I verified all AI-generated content: no fabricated/hallucinated
APIs, dependencies, citations, or placeholder content; any AI-suggested
dependency was confirmed to exist.
- [x] Any inherited/reused third-party material retains its original
license and is identified (not represented as public domain).

## Type of Change

- [x] New tool/editor integration (`integrations/`)
- [x] Documentation update
- [x] Infrastructure/tooling change

## Motivation

Toolchain currency for the generic devenv image (item 1 of
#418): devenv 2.x is absent from
`nixos-25.05` and `nixos-25.11` and first appears in `nixos-26.05`. This
PR is only the pin bump plus consumer documentation; size/startup
measurement, the `devenv container` generation model, and persistence
docs from that issue are left for follow-ups.

This satisfies the substrate requirement in
GSA-TTS/agentic-coding-quickstart#474 (ADR-0030: a channel carrying the
intended devenv major, with the major recorded in the image contract),
so it should land before GSA-TTS/agentic-coding-quickstart#474 claims
that requirement is met. The dependency is conceptual: that PR pins no
devenv image tag, so nothing enforces the order. `nixos-26.05` is the
only channel that is both devenv 2.x and release-pinned: 2.2 and later
exist only in `nixpkgs-unstable` (currently 2.4.0), and devenv 2.2
stopped building for `x86_64-darwin` (devenv v2.2 release notes).

## Testing

- [x] Ran `make validate` locally (all checks pass)
- [x] Tested with at least one real scenario
- [x] Commit messages follow [Conventional
Commits](https://www.conventionalcommits.org/) format (see
[CONTRIBUTING.md](../CONTRIBUTING.md#commit-message-format))

Build: `workflow_dispatch` of `devenv-image.yml` on this branch
succeeded on all four legs (shell/opencode × amd64/arm64); the manifest
job skipped as designed off `main`. Run:
https://github.com/GSA-TTS/agentic-coding-patterns/actions/runs/37489740805

Image smoke test (arm64 `devenv-opencode` digest from that run, in an
msb sandbox created through `acq` with a real kit stack): `devenv
version` → `devenv 2.1.2 (aarch64-linux)`; installer Nix 2.24.9 and
direnv 2.37.1 present; non-interactive `bash -c 'devenv version'` works;
`agent:agent` owns `/nix`, `/nix/store` (1775) and `/nix/var/nix/db`. A
minimal devenv 2.x project built in the sandbox: its outputs are
registered in the shared store DB (schema 10) as seen by the installer's
`nix path-info`, `nix store verify` passes, and no group/world-writable
outputs are produced (the single-user-store regression fixed upstream in
cachix/devenv#2757 is absent). Locked GitHub inputs, cache.nixos.org and
cachix fetches all succeeded through the kit-provided CA via devenv's
bundled Nix.

Consumer compatibility (devenv 2.1.2 from the same nixpkgs rev, run
against scratch copies of two team repos that stay locked to 1.x
modules): a Python/venv/tasks repo passes unchanged; a
Ruby/Postgres/`git-hooks` repo fails until the `git-hooks` input is
declared in `devenv.yaml`, then passes including `devenv up -d`
Postgres. `devenv shell` under 2.x rewrites `devenv.lock` (drops
implicit `git-hooks`/`pre-commit-hooks`/`flake-compat` nodes) and a 1.x
CLI adds them back at current HEAD; `.devenv/` is reusable across
majors. These behaviors are what the README section documents.

## Safety Checklist

- [x] No secrets, API keys, tokens, or passwords included
- [x] No PII (names, emails, SSNs, addresses)
- [x] No CUI (Controlled Unclassified Information)
- [x] No internal URLs, hostnames, or system paths
- [x] No customer data or proprietary information

## Quality Checklist

- [x] Plain language used (Grade 10 or below preferred)

## Validation Results

```
make validate

✓ All validators passed
```

## Related Issues

Relates to #418

## Additional Context

The feature-branch build wrote to the shared
`devenv-*:cache-{amd64,arm64}` registry cache tags, so the next `main`
build after merge rebuilds more layers than usual.

Known follow-ups not in this PR: a post-build smoke-test job in
`devenv-image.yml` (fixture with `git-hooks`, `direnv exec . true`,
store-permission check); `devenv processes down` can time out and
SIGKILL the process group without stopping a service's children
(observed with Postgres under the 2.1.2 CLI); the `devenv update` path
(2.x modules, `prek` default, native process manager) could not be
exercised behind a GitHub-API-rate-limited proxy because the bundled
Nix's libgit2 fallback fails with `authentication required but no
callback set`.

## Reviewer Notes

**Reviewers should verify:**

- [ ] `NIXPKGS_REV` resolves to a `nixos-26.05` commit and the
Dockerfile comment matches
- [ ] `VERSION` is `2.0.0` and not previously published
- [ ] README 2.x consumer notes match the migration guide's documented
breaking changes
- [ ] No sensitive information included
- [ ] `make validate` passes in CI