ci: make Nix test guest image pins resilient

Description

The Nix-managed test guest definitions fetch Ubuntu cloud images from mutable release URLs with fixed-output hashes. When Ubuntu republishes an image at the same URL, Nix correctly rejects the download with a hash mismatch and the VM E2E lane fails before tests start.

Context

PR #3004 exposed this in the rootless Podman Ubuntu 26.04 Nix VM lane. The failing job was e2e / E2E (rust-podman-rootless, Ubuntu 26.04 Nix VM) in run https://github.com/NVIDIA/OpenShell/actions/runs/33151151454.

The amd64 Ubuntu 26.04 cloud image pin in nix/test-guest/distros/ubuntu-26-04.nix expected:

sha256-ncfFNjwBRqCLoMmqg02CwsbfuxxHGtmi8KuhGJ4hvgU=

CI downloaded bytes with:

sha256-gZa+nXlYBZy1bGx1yA/fbO6KiIW8FJ6nkdfbHH75MDU=

This prevented the VM image from building, so the guest E2E launcher and Rust tests never ran.

Definition of Done

• Test guest distro definitions use immutable image references, a project-controlled mirror, or another mechanism that avoids unexpected breakage when upstream release URLs are republished.
• CI failure output for image hash mismatches points maintainers to the exact distro definition and recovery path.
• The documented update workflow covers both amd64 and arm64 guest image hashes.
• The rootless Podman Ubuntu 26.04 Nix VM E2E lane can build its guest image without relying on mutable upstream bytes staying unchanged.

Start with nix/test-guest/distros/ubuntu-26-04.nix and the failing e2e / E2E (rust-podman-rootless, Ubuntu 26.04 Nix VM) job; inspect how the amd64 and arm64 image references and hashes are selected. Reproduce the image build, then verify the documented recovery/update workflow, hash-mismatch guidance, and successful guest build for the lane.