try store mounted read-only

- `--store` as per
https://blog.kotatsu.dev/posts/2023-04-21-woodpecker-nix-caching/
- `--eval-store` as per
https://kevincox.ca/2022/01/02/nix-in-docker-caching/

.woodpecker/cd.yaml

@@ -14,12 +14,14 @@ steps:
         echo "$CD_SSH_KEY" > ~/.ssh/id_ed25519
         ls -l ~/.ssh/id_ed25519
         chmod 600 ~/.ssh/id_ed25519
-      - nix-shell -p strace --run 'strace -f -o ssh-agent.log ssh-agent -s'
+      - nix-shell --eval-store local --store unix:///mnt/nix/var/nix/daemon-socket/socket?root=/mnt -p strace --run 'strace -f -o ssh-agent.log ssh-agent -s'
       - cat ssh-agent.log
       - |
         eval "$(ssh-agent -s)"
         ssh-add ~/.ssh/id_ed25519
-      - nix-shell --run 'eval "$(ssh-agent -s)" && ssh-add ~/.ssh/id_ed25519 && ssh-agent -s && SHELL=$(which bash) nixops4 apply -v default'
+      - nix-shell --eval-store local --store unix:///mnt/nix/var/nix/daemon-socket/socket?root=/mnt --run 'eval "$(ssh-agent -s)" && ssh-add ~/.ssh/id_ed25519 && ssh-agent -s && SHELL=$(which bash) nixops4 apply -v default'
     environment:
       CD_SSH_KEY:
         from_secret: cd_ssh_key
+    volumes:
+      - /nix:/mnt/nix:ro

.woodpecker/check-deployment-basic.yaml

@@ -10,4 +10,6 @@ steps:
   - name: check-deployment-basic
     image: nixos/nix
     commands:
-      - nix build --extra-experimental-features 'nix-command flakes' .#checks.x86_64-linux.deployment-basic -L
+      - nix build --eval-store local --store unix:///mnt/nix/var/nix/daemon-socket/socket?root=/mnt --extra-experimental-features 'nix-command flakes' .#checks.x86_64-linux.deployment-basic -L
+    volumes:
+      - /nix:/mnt/nix:ro