Make the build shell pure to avoid accidental host environment deps

Previously we got nix from the host env without even realizing it.  As soon as
it upgraded things broke.