devenv image: measure size and startup, enforce a closure-size budget #510

Context

Split out from #418. The devenv image (integrations/isolation/images/devenv/) moved to devenv 2.1.2 on nixos-26.05 in VERSION 2.0.0. Nobody has measured its size or startup cost against the 1.x image yet.

Scope

1. Measure compressed and uncompressed image size, and the Nix closure size of devenv + direnv, for the 1.x (1.0.0) and 2.x (2.0.0) images on both arches. Record the numbers in the image README.
2. Measure devenv startup (for example devenv version and direnv exec . true on a minimal fixture). Consider a statically linked devenv only if startup turns out to be a measured bottleneck.
3. Enforce a closure-size budget in CI. devenv 2.3 added a max_closure_size test limit; on the 2.1.2 image, use a plain nix path-info -S check against a threshold instead.

Depends on

The devenv 2.3 figures (closure 528 MB → 376 MB, bundled Nix 2.35.2) and max_closure_size need devenv 2.3+, which depends on the channel decision in #418. Steps 1–2 can start on the current image.

Verification

• Before/after numbers recorded in the README.
• A devenv-image.yml run fails when the closure is over budget (test by temporarily lowering the threshold).