Odyssey's Firecracker image is Alpine on a read-only root with no xz,
no useradd, a 64 MiB /tmp, the only real disk at /workspace, and no
devpts mounted. Each of those breaks a different part of the obvious
'install nix and build' path, and the runner caps how long a single
command line can be, so the workarounds cannot live in the command box.

The script mounts devpts (nix needs a pty to capture builder output),
points TMPDIR at the big volume, then picks the best available store:
nix on PATH, else a native install if /nix can be a mountpoint, else
nix-portable with bwrap in preference to proot.

POSIX sh, verified against dash and busybox ash and clean under
shellcheck -s sh.