[Aozora-Wings]

Summary

This PR adds NixOS support for the Linux build. NixOS is an immutable system: the Nix store (where the package is installed), /etc/hosts and the system CA certificate store are all read-only at runtime and managed declaratively. The current Linux implementation assumes writable /etc/hosts, writable system certificate store, and a subprocess accelerator that can be spawned with elevated privileges — none of which hold on NixOS.

All changes are guarded by a runtime NixOS detection (IsNixOS, checks /etc/NIXOS or ID=nixos in /etc/os-release) and do not affect other platforms.

Changes

• Platform detection (LinuxPlatformServiceImpl.NixOS.cs): IsNixOS helper shared by all adaptations.
• Certificates:
  • Skip pkexec install/remove of system certificates on NixOS (system trust is declarative via security.pki.certificateFiles).
  • BundledCertificateHelper: support a bundled CA certificate (cer + pfx) shipped in the package, synced to AppData at startup so the proxy private key always matches the system-trusted cert.
  • -clt nixos -gcert command to export the root certificate for declarative installation.
• Hosts (HostsFileServiceImpl): on NixOS, dump the accelerator's host entries to AppData as a reference file instead of writing /etc/hosts, for merge into the system's declarative networking.hosts.
• Accelerator as a systemd service: on NixOS the accelerator cannot be spawned as a child process with elevated privileges (Nix store is read-only, file capabilities return EPERM, and privilege escalation would lose the wrapper-injected runtime environment). Instead the UI writes the IPC parameters (pipe name / pid / proxy mode) to an environment file and a systemd system service (steampp-accelerator, User=<main user>, AmbientCapabilities=cap_net_bind_service) starts the accelerator on demand. UI shows the service state.
• Publish tool (IDotNetPublishCommand): new explicit --nixos flag. When set, publish as directory (not SingleFile) and do not bundle the .NET runtime (Nix packaging invokes the system dotnet via a wrapper; a bundled runtime copied from the Nix store would embed store paths and break on other machines). The /etc/NIXOS auto-detection is kept for backward compatibility, so any build machine (e.g. official CI on ubuntu runners) can produce the NixOS-adapted package by passing --nixos.
• Build: pin Avalonia.BuildServices 0.0.29 across Avalonia projects; use sans-serif as the default font family on Linux.

Testing

• Built and published for linux-x64 on NixOS (see fork's nixos-branch CI and the nixos-branch release artifacts).
• GUI, certificate trust and accelerator service verified on NixOS physical hardware.
• Non-NixOS paths are unchanged (all new behavior is behind IsNixOS).

Notes

• The Nix packaging layer (flake, NixOS module) lives in the fork repository and is intentionally not part of this PR.
• Program.cs font change: Avalonia's default font family resolution picks a bundled font on Linux that renders poorly in CJK locales; sans-serif falls back to the system font stack.