Add CI lint to check artifacts for nix leakage

Now that we are using nix to provide reproducible environments on Darwin we need to be very certain that no nix paths leak into the final binary artifacts. We should add a job to verify this.