ci: stop mounting /etc/ssl/certs into the Nix sandbox

.github/workflows/ci.yml

@@ -358,13 +358,17 @@ jobs:
       # Sandboxed, because the generated trycmd suites were recorded as the
       # `nixbld` user the sandbox presents. Unsandboxed, a build runs as
       # nixbld1, and dozens of their cases fail on that name alone.
+      #
+      # Nix mounts ssl-cert-file at /etc/ssl/certs/ca-certificates.crt for
+      # each fixed-output derivation, the crate downloads among them. Do not
+      # add /etc/ssl/certs to the sandbox paths: mounted first, it already
+      # holds that file, and every download fails with "File exists".
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
         with:
           extra-conf: |
             sandbox = true
             ssl-cert-file = /etc/ssl/certs/ca-certificates.crt
-            extra-sandbox-paths = /etc/ssl/certs
             user-agent = lez-ci (https://github.com/fxrdhan/lez)
       - name: Configure curl user-agent for crates.io
         run: |

.github/workflows/nix-canary.yml

@@ -27,14 +27,15 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
       # Sandboxed, as in CI: the generated trycmd suites pass only as the
-      # `nixbld` user the sandbox presents.
+      # `nixbld` user the sandbox presents. And, as there, without
+      # /etc/ssl/certs among the sandbox paths, which breaks every crate
+      # download: see the Nix job in ci.yml.
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
         with:
           extra-conf: |
             sandbox = true
             ssl-cert-file = /etc/ssl/certs/ca-certificates.crt
-            extra-sandbox-paths = /etc/ssl/certs
             user-agent = lez-ci (https://github.com/fxrdhan/lez)
       - name: Configure curl user-agent for crates.io
         run: |