Refactor pipelines to cache nix dependencies in the docker image

It looks to me like currently we want to run all of our commands inside the nix shell produce from ci/default.nix. Currently we achieve this by prepending all of our commands with nix run -f ci -c ... and storing the nix store in Gitlab's cache.

I think it would be better to bake a docker image made using nix from ci/default.nix's environment and using that docker image rather than the generic nix one. We could have a pipeline that can create one of these images and upload it to the registry that we can manually trigger when the configuration changes, though I think that's rare.

I think this would help with #38 (closed) because the heavy thing there is building this environment. Though if a runner is struggling to do that maybe it would also struggle to build head.hackage packages themselves.

I'd be happy to implement this. How does that sound?