build: make Go and Python builds fully offline (hermetic Nix build)

The Nix build previously fetched Go modules from goproxy.cn and Python
build deps from PyPI during the build phase, relying on network leaking
into the sandbox. This is non-reproducible and breaks whenever the
sandbox resolver is unreachable (e.g. pc13v's loopback dnsmasq).

Go:
- Vendor all three modules (frontend/apiserver, frontend/xcecli,
  autoscaler/providers/baidu/src/bcctool) and commit vendor/ trees.
- tools/go_build now builds with GOFLAGS=-mod=vendor and GOPROXY=off
  instead of GOPROXY=https://goproxy.cn.

Python (xceadmin):
- Add setuptools + wheel to xce.nix nativeBuildInputs.
- meson-build.sh installs with pip --no-build-isolation --no-index
  --no-deps so no PyPI access happens at build time.

xceadmin install script:
- Invoke meson-install.sh via find_program('bash') instead of relying
  on its #!/usr/bin/env bash shebang, which fails in the Nix install
  sandbox (no /usr/bin/env -> 'could not be run').

Cleanup:
- Drop now-unneeded cacert and impureEnvVars=[HOME] from xce.nix and
  xcecli.nix (they only existed to enable the impure network fetch).

Docs:
- README build guide: drop '--option sandbox false' from nix build /
  nix bundle commands, note the build is now hermetic, and document the
  go mod vendor + git add vendor/ maintenance workflow.

Verified: nix build .#xcecore, .#xcecore_debug, .#xcecli, and .#xce all
succeed with the sandbox enabled.

README.md

@@ -71,14 +71,46 @@ cd xce
 cd xce/src
 
 # for build debug version
-nix build --option sandbox false .#xcecore_debug
+nix build .#xcecore_debug
 
 # for normal build
-nix build --option sandbox false .#xcecore
+nix build .#xcecore
 ```
 
 You can find the generated binaries at =result= directory
 
+> 构建现在是**完全 hermetic（离线）**的，无需再加 `--option sandbox false`。
+> 所有 Go 依赖都已 vendored（`go mod vendor`，提交到各模块的 `vendor/` 目录），
+> Python 组件 `xceadmin` 也通过 `pip install --no-build-isolation --no-index`
+> 从 nix 环境安装，构建阶段不再访问网络。因此在开启 sandbox（`sandbox = true`）
+> 的机器上也能直接构建，不会再出现向 `goproxy.cn` / PyPI 请求而 DNS 解析失败的问题。
+
+### 3.3.1 更新 Go 依赖（vendor 维护）
+
+Go 模块（`frontend/apiserver`、`frontend/xcecli`、
+`autoscaler/providers/baidu/src/bcctool`）的依赖以 `vendor/` 目录的形式提交进仓库，
+构建时 `tools/go_build` 使用 `GOFLAGS=-mod=vendor`、`GOPROXY=off` 完全离线编译。
+
+当修改了某个模块的 `go.mod` / `go.sum`（新增、升级、删除依赖）后，需要在
+**`nix develop` 环境内**重新生成对应模块的 `vendor/` 并提交：
+
+```sh
+cd xce/src
+nix develop
+
+# 以 apiserver 为例，其他两个模块同理
+cd frontend/apiserver
+go mod tidy
+go mod vendor
+cd -
+
+# vendor/ 必须被 git 跟踪，否则 flake 构建（只读取 git 已跟踪/暂存的文件）看不到它
+git add frontend/apiserver/go.mod frontend/apiserver/go.sum frontend/apiserver/vendor
+```
+
+> 注意：`nix build` 从 git 树取源码，**未被 git add 的 `vendor/` 文件不会进入构建**，
+> 会导致 `-mod=vendor` 报 `inconsistent vendoring` 而失败。改完依赖记得 `git add vendor/`。
+
 ## 3.4 build (for daily develop)
 
 日常开发推荐直接使用 `src/tools/xce-build.sh`（若在 Claude Code 中开发，对应的是 `/xce-build` skill），
@@ -132,7 +164,7 @@ meson compile -C xce.build
 
 ```sh
 cd xce/src
-nix bundle --bundler github:ralismark/nix-appimage --option sandbox false .#xce
+nix bundle --bundler github:ralismark/nix-appimage .#xce
 ```
 
 This will create all in one AppImage file which contains everything for package delivery.