Wait with making /etc unwritable until after build env setup

[yorickvP]

Motivation

The builder child still has to touch /etc to setup nsswitch.conf and bind mounts. Wait until after this to make /etc unwritable.

Context

Fixes #7852. Was broken in #7830.

Checklist for maintainers

Maintainers: tick if completed or explain if not relevant

• agreed on idea
• agreed on implementation strategy
• tests, as appropriate
  • functional tests - tests/**.sh
  • unit tests - src/*/tests
  • integration tests - tests/nixos/*
• documentation in the manual
• code and comments are self-explanatory
• commit message explains why the change was made
• new feature or incompatible change: updated release notes

[yorickvP]

nix flake check passes.

[cole-h]

(Since the previous fix that this amends was also backported to 2.12 and 2.13, please add those labels here, @ whichever maintainer gets to this first :D)

[thufschmitt]

Thanks

[github-actions]

Git push to origin failed for 2.12-maintenance with exitcode 1

[github-actions]

Successfully created backport PR for 2.12-maintenance:

• [Backport 2.12-maintenance] Wait with making /etc unwritable until after build env setup #7877

[github-actions]

Successfully created backport PR for 2.13-maintenance:

• [Backport 2.13-maintenance] Wait with making /etc unwritable until after build env setup #7878

[github-actions]

Git push to origin failed for 2.13-maintenance with exitcode 1

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/tweag-nix-dev-update-45/26397/1