Make the wrapper work both inside the Nix flake / Docker image (where
rust-analyzer comes from PATH) and from a standalone release tarball
(where rust-analyzer sits next to the wrapper). Fail fast with a
friendly error pointing at rustup when cargo or rustc is missing on
the host.

Add a release-tarballs matrix job alongside the existing Docker image
release. Each tarball pairs the scip-rust wrapper with the pinned
upstream rust-analyzer binary for that target, giving non-Nix users a
small, self-contained download (~16 MB). Users still need a Rust
toolchain on PATH (rustup); the wrapper enforces this.

Targets:
- aarch64-apple-darwin
- x86_64-apple-darwin
- aarch64-unknown-linux-gnu  (rust-analyzer has no aarch64 musl build)
- x86_64-unknown-linux-musl

Sourcegraph-internal SOC 2 audit bot. Not relevant to this repo.

The flake's packages.docker output produces the same kind of image the
hand-written Dockerfile did (scip-rust + rust-analyzer + rustc + cargo
+ ca-certs + git, with a /work workdir), so there's no need to keep
two parallel build paths.

- Delete Dockerfile.
- release.yml release-image: install Nix via DeterminateSystems'
  installer, 'nix build .#docker', then docker load / tag / push
  (matches the scip-go pattern). Tag scheme and DockerHub destination
  are unchanged.
- Delete test-container.sh and the container-test.yml workflow that
  ran it; both existed only to smoke-test the Dockerfile and have no
  equivalent purpose now that nix flake check exercises the image
  build.

rustup's rust-analyzer shim is guaranteed to match the user's active
toolchain (incl. rust-toolchain.toml resolution); a pinned bundled
copy can drift. Defer to PATH and only fall back to an adjacent
bundled binary when nothing better is installed. Collapse the tool
existence checks into a single loop now that command -v handles both
a bare name and an absolute path.

The trace 'exec rust-analyzer scip .' adds noise to stderr (where
rust-analyzer's own progress also lives) without conveying anything
the user couldn't already infer. Anyone who wants a trace can run
'sh -x scip-rust'.

The bundled rust-analyzer + wrapper tarballs duplicated work that
rust-lang/rust-analyzer already does well for every target we care
about. Drop the matrix job, simplify the wrapper to just require
rust-analyzer on PATH, and document the direct invocation in the
README. The docker image continues to be published for users who
want a single artifact.

Previously, the Nix-built scip-rust wrapper used runtimeInputs to
prepend bundled cargo, rustc, and rust-analyzer to PATH, shadowing any
toolchain the user had installed. This broke projects with pinned
toolchains via rustup or rust-toolchain.toml, since rust-analyzer
shells out to cargo for metadata.

Switch to per-tool SCIP_RUST_FALLBACK_* env vars via runtimeEnv, and
have the script append a tool's fallback bin directory only when that
tool is not already on PATH. This keeps the user's toolchain in charge
while still providing a working out-of-the-box experience in CI or
container environments without a Rust toolchain installed.

Replaces the nixfmt-only check with a formatting check that also runs
shfmt against the scip-rust shell script (configured with -i 4 -ci to
match the existing style). Adds shfmt to the devshell alongside nixfmt
and shellcheck.

- nix flake check on PRs and pushes to main.
- docker job builds the image and indexes ripgrep through it,
  asserting the produced index is non-negligible (>=100 KB).
- index job builds scip-rust via nix build and runs it against a
  small matrix of representative Rust repos (ripgrep, tokio, serde,
  ruff), validating the resulting SCIP index with the scip CLI.
- renovate custom manager keeps the matrix and docker job refs
  in sync with upstream releases; tokio uses extractVersion to
  filter the tokio-x.y.z tag namespace.
- scip-rust forwards extra args to rust-analyzer (defaults to ".").

A rustup install whose `rust-analyzer` component is not installed still
exposes a `rust-analyzer` proxy on PATH, so the previous `command -v`
check would pass and the wrapper would then exec the broken proxy
("Unknown binary rust-analyzer in official toolchain ..."). Probe each
tool by running `--version` instead, and prepend the Nix fallback so it
wins over the broken proxy.

Local `nix build` runs that compete for `./result` create
`./result-1`, `./result-2`, ... — ignore the whole family. The
stray `result-1` symlink was accidentally committed in the
previous commit.