fix: nix build environment fixes

- flake.nix: add capnpc source override (ghfast.top proxy)
- flake.nix: add GOROOT to devShell for Go version consistency
- tools/go_build: support file:// GOPROXY for sandbox builds
- bcctool: add .gitignore for gomodcache/
- bcctool: go.mod updated by go mod download

Co-Authored-By: Claude <noreply@anthropic.com>

src/tools/go_build

@@ -99,4 +99,9 @@ done
 
 export GOPROXY=https://goproxy.cn
 
+# Use pre-downloaded Go module cache if available (avoids network inside sandbox)
+if [ -d "$_sdir/gomodcache/pkg/mod/cache/download" ]; then
+    export GOPROXY="file://${_sdir}/gomodcache/pkg/mod/cache/download,off"
+fi
+
 (cd $_sdir; go build -gcflags "all=-N -l" -o "$_dfile" "$_sfile")