[Avimitin]

Summary

• force Maven artifact builders to use the pinned cacert bundle from the Nix store
• keep TLS certificate verification enabled for every cache-miss download
• prevent a daemon-supplied NIX_SSL_CERT_FILE=/no-cert-file.crt from overriding the builder certificate path
• retain the standard Nix fetcher proxy environment and recursive NAR-hash verification
• run the Chisel integration workflow for pull requests again, while retaining its weekly schedule

Security model

Nixpkgs fetchurl can use /no-cert-file.crt and curl --insecure for a known fixed-output hash because Nix still verifies content integrity. MIF does not need that tradeoff: cacert is an explicit builder input and Maven repositories are expected to use authenticated HTTPS.

A missing artifact therefore receives two checks:

1. curl authenticates the Maven server with the pinned CA bundle.
2. Nix verifies the complete artifact directory against its recursive NAR hash.

If the derivation output already exists, the downloader does not run.

Validation

• rebuilt a real Maven fixed-output derivation while exporting NIX_SSL_CERT_FILE=/no-cert-file.crt
• confirmed the generated derivation uses the cacert store path and contains no --insecure option
• nix build .#checks.x86_64-linux.maven-fetch-environment --no-link
• nix flake check --no-build
• nix develop .#ci --command mill --no-daemon mif.test (137/137)

The Chisel integration job is enabled on pull_request so this PR runs the clean-runner integration coverage.