build: make Go and Python builds fully offline (hermetic Nix build)

The Nix build previously fetched Go modules from goproxy.cn and Python
build deps from PyPI during the build phase, relying on network leaking
into the sandbox. This is non-reproducible and breaks whenever the
sandbox resolver is unreachable (e.g. pc13v's loopback dnsmasq).

Go:
- Vendor all three modules (frontend/apiserver, frontend/xcecli,
  autoscaler/providers/baidu/src/bcctool) and commit vendor/ trees.
- tools/go_build now builds with GOFLAGS=-mod=vendor and GOPROXY=off
  instead of GOPROXY=https://goproxy.cn.

Python (xceadmin):
- Add setuptools + wheel to xce.nix nativeBuildInputs.
- meson-build.sh installs with pip --no-build-isolation --no-index
  --no-deps so no PyPI access happens at build time.

xceadmin install script:
- Invoke meson-install.sh via find_program('bash') instead of relying
  on its #!/usr/bin/env bash shebang, which fails in the Nix install
  sandbox (no /usr/bin/env -> 'could not be run').

Cleanup:
- Drop now-unneeded cacert and impureEnvVars=[HOME] from xce.nix and
  xcecli.nix (they only existed to enable the impure network fetch).

Docs:
- README build guide: drop '--option sandbox false' from nix build /
  nix bundle commands, note the build is now hermetic, and document the
  go mod vendor + git add vendor/ maintenance workflow.

Verified: nix build .#xcecore, .#xcecore_debug, .#xcecli, and .#xce all
succeed with the sandbox enabled.

src/nixSupport/xce.nix

@@ -54,6 +54,11 @@ stdenv.mkDerivation {
     }))
     which
     findutils
+    # NOTE: `cacert` was previously required so the Go build could make TLS
+    # requests to the module proxy (goproxy.cn) during the build phase. The
+    # Go builds are now fully offline against each module's committed vendor/
+    # tree (tools/go_build sets GOFLAGS=-mod=vendor, GOPROXY=off), so no TLS /
+    # network happens in the build phase and cacert is no longer needed here.
     (libuv.overrideAttrs (oldAttrs: {
       separateDebugInfo = true;
     }))
@@ -76,19 +81,26 @@ stdenv.mkDerivation {
       separateDebugInfo = true;
     }))
     packcc
-    cacert
     # Python — for xceadmin (admin config tool, src/xceadmin/). pycapnp links
     # against the capnproto C++ runtime above; nix's python3Packages.pycapnp
     # handles that link correctly, unlike a plain `pip install pycapnp`.
     # See .kiro/specs/admin-config-tool/brief.md "Nix Environment".
     python3
     python3Packages.pip
+    # setuptools + wheel: xceadmin (src/xceadmin) is a PEP 517 package with
+    # build-backend = setuptools.build_meta. Its meson-build.sh installs it
+    # with `pip install --no-build-isolation` (offline, see that script), so
+    # the build backend must already be present in the environment rather
+    # than fetched from PyPI at build time (no network in the Nix sandbox).
+    python3Packages.setuptools
+    python3Packages.wheel
     python3Packages.pycapnp
     python3Packages.pyyaml
     python3Packages.jsonschema
     python3Packages.click
     python3Packages.pytest
     python3Packages.ruff
+    # cacert intentionally removed -- see comment above libuv override.
   ]  ++ (if withDebug then [
     (librtti_debug.overrideAttrs (oldattrs: {
       separateDebugInfo = true;
@@ -102,7 +114,11 @@ stdenv.mkDerivation {
   dontStrip = (withDebug || withAsan);
   separateDebugInfo = (withDebug || withAsan);
 
-  impureEnvVars = [ "HOME" ];
+  # impureEnvVars = [ "HOME" ] was previously needed so the Go build could
+  # reuse the host module cache / credentials while fetching from goproxy.cn.
+  # The Go builds are now fully offline (vendored, GOPROXY=off) and
+  # tools/go_build sets its own HOME=$TMPDIR, so no host env is needed --
+  # dropping it keeps the derivation pure/reproducible.
 
   # build-time-versioning task 2.2 (remediation round): build_time is
   # computed HERE, in the build phase, not at flake-evaluation time --

src/nixSupport/xcecli.nix

@@ -17,14 +17,16 @@ stdenv.mkDerivation {
     meson
     ninja
     go
-    cacert
+    # cacert removed: Go build is now offline (vendored, GOPROXY=off) --
+    # see nixSupport/xce.nix and tools/go_build.
     which
     findutils
   ];
 
   build-system = [ pkgs.meson ];
 
-  impureEnvVars = [ "HOME" ];
+  # impureEnvVars = [ "HOME" ] removed: offline vendored Go build needs no
+  # host env; tools/go_build sets its own HOME. See nixSupport/xce.nix.
 
   # See xce.nix for why build_time is computed here (build phase) rather
   # than at flake-evaluation time.