pin a hopefully-working nixos/nix docker image

.circleci/config.yml

@@ -144,8 +144,11 @@ jobs:
         type: "string"
 
     docker:
-      # Run in a highly Nix-capable environment.
-      - image: "nixos/nix:latest"
+      # Run in a highly Nix-capable environment.  We used to use `latest` but
+      # one day someone pushed a bad revision to it and our CI broke.  So now
+      # we just pin some recent version.  Who would have thought a floating
+      # dependency would cause build instability?
+      - image: "nixos/nix:2.3"
 
     # Tahoe-LAFS requires more memory than we get from the default resource
     # class and sometimes we have to build it.