libstore/build: automatic clean up of unsuccessfully built scratch outputs

When a build fails, its scratch output paths are not cleaned up.

Until recently, this was deemed not a problem but as part of the effort
to harden the Nix builds and protect these paths against being part of a
staged attack (race conditions, etc.), we automatically cleanup after
failed builds.

Fixes CVE-2025-52992.

Change-Id: I58481b1cc83826298b9d80d37fecf81f117ccb09
Signed-off-by: Raito Bezarius <raito@lix.systems>

doc/manual/rl-next/aggressive-derivation-output-cleanups.md

@@ -0,0 +1,15 @@
+---
+synopsis: "Always clean up scratch paths after derivations failed to build"
+issues: []
+cls: [3444]
+category: "Fixes"
+credits: ["raito", "horrors"]
+---
+
+Previously, scratch paths created during builds were not always cleaned up if
+the derivation failed, potentially leaving behind unnecessary temporary files
+or directories in the Nix store.
+
+This fix ensures that such paths are consistently removed after a failed build,
+improving Nix store hygiene, hardening Lix against mis-reuse of failed builds
+scratch paths.