New build system using nix

[mvachhar]

This PR is a continuation of the work started by @daniel-noland to move to a proper nix based build system.

Most of this PR was built based on #1275 and the work of Claude Code using Opus 4.6. As such it should be reviewed carefully. I have tried to do the work in small chunks with the AI to get some review as we go along, but I am not a nix expert and had to rely a bit on the AI's judgement as to the best approach for certain things.

TODO:

• Make failing new sanitizer runs optional - the sanitizers found real bugs we need to fix in separate PRs
  • These got commented out, the github action-fu to make it work is too hard for this PR
• ~~ Create cachix "githedgehog" cache so that these runs come from the cache ~~ DONE
• Have @Fredi-raspall, @qmonnet, and @daniel-noland rebase on this branch to make sure their workflow still works
• Careful manual review of this PR before signing off
• Co-pilot review of this PR before signoff DONE
• Remove scripts/todo.sh. DONE
• Remove scripts/install-real-nix.sh. DONE
• Make sure the proper just targets for building and pushing containers is there (I believe we are good, but I want to confirm)

[Copilot]

Pull request overview

This PR continues the migration to a Nix-based build and CI workflow, replacing the prior compile-env/docker-based approach and wiring sysroot/toolchain configuration through Nix shells and Nix builds.

Changes:

• Replaces the legacy compile-env + fake-nix workflow with default.nix/overlays, nix-shell, and updated just recipes.
• Updates CI (dev.yml) to build/test via Nix targets and introduces new Nix packaging pieces (FRR packaging, platform/profile plumbing).
• Refactors sysroot usage in Rust build scripts and updates docs to match the new Nix-first workflow.

Reviewed changes

Copilot reviewed 55 out of 56 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
testing.md	Updates testing instructions to assume nix-shell tooling.
sysfs/build.rs	Removes sysroot build script logic.
sysfs/Cargo.toml	Drops dpdk-sysroot-helper build-dependency.
shell.nix	Switches shell entrypoint to default.nix devenv.
scripts/update-doc-headers.sh	Bumps KaTeX version used in docs.
scripts/todo.sh	Adds a Nix-based build/test “checklist” script.
scripts/test-runner.sh	Removes legacy docker-based test runner wrapper.
scripts/rust.env	Removes legacy RUSTFLAGS/profile env file.
scripts/k8s-crd.env	Updates gateway CRD ref env file (now likely legacy).
scripts/installl-real-nix.sh	Adds helper to replace “fake nix” with real Nix install.
scripts/dpdk-sys.env	Updates pinned dpdk-sys commit.
scripts/doc/custom-header.html	Updates KaTeX CDN links and integrity hashes.
rust-toolchain.toml	Removes rustup toolchain file in favor of Nix toolchain sourcing.
routing/Cargo.toml	Cleans tokio features and adds dev tokio “full”.
npins/sources.json	Updates Nix pins (crane, frr, gateway, nixpkgs, rust, rust-overlay).
nix/profiles.nix	Adjusts compile/link/security profile flags and profile mapping.
nix/platforms.nix	Adds platform name mapping for bluefield2 → bluefield.
nix/pkgs/frr/patches/yang-hack.patch	Adds FRR/libyang-related patch.
nix/pkgs/frr/patches/xrelifo.py.fix.patch	Adds FRR python/xrelfo patch.
nix/pkgs/frr/default.nix	Introduces FRR derivation with configurable protocol support.
nix/pkgs/frr/clippy-helper.nix	Adds split derivation for FRR “clippy” tool for cross builds.
nix/pkgs/dpdk/default.nix	Simplifies DPDK build params and uses platform-provided properties.
nix/overlays/llvm.nix	Reworks LLVM+Rust toolchain overlay to source versions from pins.
nix/overlays/frr.nix	Adds overlay customizing dependencies for FRR static/cross builds.
nix/overlays/default.nix	Registers new overlays (rust/llvm/dataplane/frr).
nix/overlays/dataplane.nix	Wires platform/profile into DPDK build and tweaks deps.
nix/overlays/dataplane-dev.nix	Uses llvmPackages’ stdenv and adds a static-leaning gdb override.
net/src/buffer/test_buffer.rs	Cleans doc-only import; adds explicit PacketBuffer doc link.
mgmt/tests/reconcile.rs	Adds VM-runner attribute to a test.
mgmt/src/tests/mgmt.rs	Removes unused imports and disables a VM test during refactor.
mgmt/Cargo.toml	Adds n-vm + tracing-subscriber for tests.
k8s-intf/build.rs	Refactors CRD generation to OUT_DIR and env-driven inputs.
k8s-intf/Cargo.toml	Swaps build deps to dpdk-sysroot-helper.
justfile	Replaces compile-env/sterile/docker flows with Nix build/test/container commands.
init/build.rs	Switches to dpdk_sysroot_helper::use_sysroot() behind feature gate.
init/Cargo.toml	Introduces sysroot feature and makes sysroot helper optional.
hardware/src/os/mod.rs	Fixes a typo in a clippy lint comment.
hardware/build.rs	Switches to centralized use_sysroot().
dpdk/src/lcore.rs	Updates lcore ID call to rte_lcore_id().
dpdk/build.rs	Switches to centralized use_sysroot().
dpdk-sysroot-helper/src/lib.rs	Changes sysroot discovery to DATAPLANE_SYSROOT and adds use_sysroot().
dpdk-sys/build.rs	Updates bindgen/sysroot handling and link libs list.
development/code/running-tests.md	Updates test-running docs to Nix-first commands.
default.nix	Major Nix build definition: dev shell env, profiles, test archives, container tars.
dataplane/src/drivers/dpdk.rs	Gates DPDK driver file behind dpdk feature.
dataplane/build.rs	Switches to centralized use_sysroot() behind dpdk feature.
dataplane/Cargo.toml	Makes dpdk deps optional behind a dpdk feature (default on).
cli/build.rs	Removes sysroot build script logic.
cli/Cargo.toml	Drops dpdk-sysroot-helper build-dependency.
README.md	Updates developer setup/docs to nix-shell workflow.
Cargo.toml	Updates workspace version and dependency versions.
Cargo.lock	Updates lockfile to match dependency/version changes.
.github/workflows/dev.yml.old	Keeps old workflow as .old (new file added).
.github/workflows/dev.yml	Reworks CI to use Nix builds and archives.
.envrc	Simplifies direnv env vars for the new devroot/sysroot layout.
.cargo/config.toml	Updates env vars and rustflags for sysroot/devroot-based builds.

[Copilot]

Pull request overview

Copilot reviewed 64 out of 68 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

.github/workflows/dev.yml:224

confidence: 9
tags: [logic]

This `if:` condition references `inputs.debug_enabled`, but this workflow also runs on non-`workflow_dispatch` events where the `inputs` context may be undefined (this previously caused expression-evaluation failures elsewhere in this workflow). Prefer `github.event.inputs.debug_enabled` (or gate via a default) to avoid workflow parsing/evaluation errors on PR/push runs.

  - name: "Setup tmate session for debug"
    if: ${{ failure() && github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
    uses: "mxschmitt/action-tmate@v3"

</details>