docs: document local Nix setup with the OpenShell binary cache #4935

User Story

I develop OpenShell on macOS (Apple Silicon) and use nix develop and nix run .#tmachine / .#build-artifacts-* to run tmachine environments locally. On a fresh Nix install the first build took over an hour, and an earlier non-standard Nix install broke TLS for host-side tools, so I need the contributor docs to say how to set Nix up the way CI does.

Description

Add a short Nix setup section to the contributor prerequisites:

• Recommend Determinate Nix, which CI uses. Some other installers leave Nix's OpenSSL without a CA bundle on macOS (no default profile, no NIX_SSL_CERT_FILE), which breaks HTTPS from Nix-provided tools such as ansible-galaxy (see fix(tmachine): provide a CA bundle for host tools on macOS #4930).
• Explain that flake.nix's nixConfig substituter is ignored for non-trusted users, and how to add https://openshell.cachix.org and its key to the system Nix config and restart the daemon, without adding the user to trusted-users.
• Note that the "ignoring untrusted flake configuration setting" warnings are harmless, and that nix config show substituters is the check.
• Link to it from TESTING.md and the test-guest README instead of repeating it.

Context

Found while running #4773's tmachine runner locally. Without the cache, nix build --dry-run .#devShells.aarch64-darwin.default has 88 derivations to build (including cross GCC); with it, 1.

Definition of Done

• CONTRIBUTING.md has a Nix setup section covering the installer, the binary cache and how to verify it.
• TESTING.md and nix/test-guest/README.md link to it.
• mise run markdown:lint passes.