feat(libstore/build): always create a new cgroup namespace

There's no reason to make it dependent upon `Xp::Cgroups`, this
increases the purity of the builders' views.

Change-Id: I3d934428177e6bb78cd700d1cce1ded8a88e9da0
Signed-off-by: Raito Bezarius <raito@lix.systems>

doc/manual/rl-next/fresh-cgroup-namespace.md

@@ -0,0 +1,10 @@
+---
+synopsis: "Builders are always started in a fresh cgroup namespace"
+cls: [1996]
+category: Breaking Changes
+credits: raito
+---
+
+If you haven't enabled the experimental `cgroups` feature, Nix previously launched builder processes in new namespaces but did not create new cgroup namespaces. As a result, derivations could access and observe the parent cgroup namespace.
+
+Although this update introduces a breaking change, it ensures that all derivations now start in a fresh cgroup namespace by default. This reduces potential impurities observable within the sandbox, improving the likelihood of reproducible builds across different environments.

lix/libstore/build/local-derivation-goal.cc

@@ -1665,10 +1665,12 @@ void LocalDerivationGoal::runChild()
             if (unshare(CLONE_NEWNS) == -1)
                 throw SysError("unsharing mount namespace");
 
+            /* Creating a new cgroup namespace is independent of whether we enabled the cgroup experimental feature.
+             * We always create a new cgroup namespace from a sandboxing perspective. */
             /* Unshare the cgroup namespace. This means
                /proc/self/cgroup will show the child's cgroup as '/'
                rather than whatever it is in the parent. */
-            if (cgroup && unshare(CLONE_NEWCGROUP) == -1)
+            if (unshare(CLONE_NEWCGROUP) == -1)
                 throw SysError("unsharing cgroup namespace");
 
             /* Do the chroot(). */