build: drop the Nix packaging and test inside the container

The deployment target is a container on TrueNAS Scale, so the flake sat on no
path between the source and the NAS. It was carried over from a sibling project
where the flake is the deployment mechanism; here it only added a second build
path and a second dependency pin.

Worse, it tested the wrong thing: `nix flake check` ran the suite against
nixpkgs' ffmpeg while the shipped artefact contains Debian's, and encoder and
muxer behaviour is exactly what these tests cover.

The Dockerfile gains a `test` stage that installs pytest and runs the suite
against the image's own ffmpeg; a failing test fails the build. CI runs
`docker build --target test` in place of the host-based Python setup, and the
push build states `target: runtime` so the published image is the lean stage
rather than the last one in the file. The runtime image carries neither the
tests nor pytest.

The release step now calls python3 rather than python, since setup-python is
no longer in the job to provide the alias.

Removes package.nix, flake.nix and flake.lock. A dev shell is a `nix shell`
away for anyone who wants one, and the README says so.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -78,8 +78,7 @@ music-mirror --source /music --mirror /music-mp3 --subdir "Artist/Album"
 `--subdir` never prunes: a partial pass cannot tell an orphan from a file
 outside its own scope.
 
-Requires `ffmpeg` and `ffprobe` on `PATH`. The container and the Nix package
-both provide them.
+Requires `ffmpeg` and `ffprobe` on `PATH`. The container image provides both.
 
 ## Running it on TrueNAS Scale
 
@@ -103,25 +102,26 @@ New Lidarr imports are picked up on the next pass. With `MUSIC_MIRROR_INTERVAL`
 at `6h` that is the worst case; run `--subdir` by hand if you want an album
 immediately.
 
-## Nix
-
-```sh
-nix run .#music-mirror -- --source ./flac --mirror ./mp3
-nix build .#music-mirror   # the test suite runs as part of the build
-nix develop                # python, pytest and ffmpeg
-```
-
-`overlays.default` provides `pkgs.music-mirror`.
-
 ## Tests
 
 ```sh
-pytest
+docker build --target test .   # what CI runs
+pytest                         # needs ffmpeg and pytest on PATH
 ```
 
-The tests run real ffmpeg encodes rather than mocking them — the interesting
+The suite runs real ffmpeg encodes rather than mocking them. The interesting
 failures are in what ffmpeg actually does with tags, cover art and container
-formats, and a mock cannot fail that way. They skip if ffmpeg is absent.
+formats, and a mock cannot fail that way — which is also why CI runs the tests
+_inside the image_, against the ffmpeg that ships, rather than against whatever
+the build runner provides. The published image is the `runtime` stage and
+carries neither the tests nor pytest.
+
+Run them directly instead if you prefer; they skip when ffmpeg is absent. On a
+Nix machine:
+
+```sh
+nix shell nixpkgs#python3Packages.pytest nixpkgs#ffmpeg -c pytest
+```
 
 ## Getting the result onto an iPod