fix(trace-fixtures): correct bogus nixos/nix container digest

[avrabe]

Summary

The docker.io/nixos/nix@sha256:4aba8f00… digest pinned in both the
trace-fixture workflows does not exist — a direct pull returns
manifest unknown. Every podman run in trace-fixtures.yml (the
nightly) and fixture-vm-flake-lock.yml would fail at the image-pull
step before doing any work.

• Replaces it with the verified multi-arch index digest for
  nixos/nix:2.24.9 (sha256:fd7a5c67…, manifest.list.v2 — podman
  resolves the right arch from it; a per-arch leaf would be a sharper,
  more fragile pin).
• Confirmed via podman run <image> nix --version → nix (Nix) 2.24.9.

This unblocks dispatching the fixture-vm flake.lock workflow, whose
artifact is the missing tools/fixture-vm/flake.lock that the nightly
guards on.

Test plan

• Dispatch fixture-vm flake.lock after merge — first real exercise
  of the rootless-podman + digest-pinned nixos/nix path.
• Commit the produced flake.lock in a follow-up PR; nightly goes live.

🤖 Generated with Claude Code

[github-actions]

Rivet verification gate

✅ 20/20 passed

	count
Passed	20
Failed	0
Skipped (no steps)	0

Filter: (and (= type "feature") (or (has-tag "v093") (has-tag "v0100")))

Failed artifacts

(none)

_{Updated automatically by tools/post_verification_comment.py. Source of truth: artifacts/verification.yaml.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!