build: drop the Nix packaging and test inside the container

The deployment target is a container on TrueNAS Scale, so the flake sat on no
path between the source and the NAS. It was carried over from a sibling project
where the flake is the deployment mechanism; here it only added a second build
path and a second dependency pin.

Worse, it tested the wrong thing: `nix flake check` ran the suite against
nixpkgs' ffmpeg while the shipped artefact contains Debian's, and encoder and
muxer behaviour is exactly what these tests cover.

The Dockerfile gains a `test` stage that installs pytest and runs the suite
against the image's own ffmpeg; a failing test fails the build. CI runs
`docker build --target test` in place of the host-based Python setup, and the
push build states `target: runtime` so the published image is the lean stage
rather than the last one in the file. The runtime image carries neither the
tests nor pytest.

The release step now calls python3 rather than python, since setup-python is
no longer in the job to provide the alias.

Removes package.nix, flake.nix and flake.lock. A dev shell is a `nix shell`
away for anyone who wants one, and the README says so.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -1,12 +1,8 @@
 .git
 .gitignore
-tests
 result
 result-*
 __pycache__
 *.pyc
 .pytest_cache
-flake.nix
-flake.lock
-package.nix
 compose.yaml