ci(nightly): re-enable nix-flake job & fix sandbox failures

[max-sixty]

Summary

Restore the nix-flake nightly job (disabled in #2647) and fix the
sandbox-specific test failures it surfaces. With this merged, the
nightly cron run is back to gating against packaging-environment bugs.

What's in here

• Build-mode snapshot redaction: 49 snapshots hardcoded
  target/debug/wt in "Invoked as:" and diagnostic output, which broke
  under crane's release builds. Collapse both modes to
  target/[BUILD_MODE]/wt in the shared insta filter.
• Nix sandbox env: add pkgs.python3 and pkgs.procps to
  worktrunk-tests' native build inputs (needed by argv-quoting,
  post-start, and pgid-invariant tests). Replace
  #!/usr/bin/env python3 with the absolute python path resolved at
  script-write time, since /usr/bin/env doesn't exist on NixOS.
• PTY filter ordering: extend add_pty_binary_path_filters'
  alternation to match the [BUILD_MODE] placeholder so PTY snapshots
  still collapse to [BIN] after the prelude rewrite runs first
  (caught by worktrunk-bot review).
• One inherited-CWD test fix: test_config_init_already_exists
  branched on whether the inherited CWD had a project config — pin
  it to a no-config tempdir so the snapshot is deterministic across
  cargo and nix.

Test plan

• nix-flake job passes in CI (1633 / 1633, was 54 failing)
• All required ci checks pass
• Auto-reviewer approved

🤖 Generated with Claude Code

[worktrunk-bot]

The new build-mode filter conflicts with add_pty_binary_path_filters (line 1211). setup_snapshot_settings runs first and rewrites /target/debug/wt to /target/[BUILD_MODE]/wt; afterwards the PTY [BIN] filter ((?:debug|release)/wt) no longer matches, so PTY snapshots that expect [BIN] now see [PROJECT_ROOT]/target/[BUILD_MODE]/wt.

The affected tests (linux, advisory) run is failing on test_approval_prompt_accept, test_approval_prompt_decline, and test_approval_prompt_mixed_approved_unapproved_accept for exactly this reason — the snapshots in tests/snapshots/integration__integration_tests__approval_pty__*.snap and …__bare_repository__* still use [BIN]. test (linux) will likely fail too once it gets there.

Suggested fix: extend the alternation in add_pty_binary_path_filters to also match the placeholder, so it still collapses to [BIN] regardless of which filter ran first:

// tests/common/mod.rs:1211
settings.add_filter(
    r"[^\s]+/target/(?:[^/\s]+/)*(?:debug|release|\[BUILD_MODE\])/wt",
    "[BIN]",
);

Happy to push that as a fixup if you'd like.