fix(ops): add +x for /nix/var/nix/gcroots

Previously, the buildkite users were not able to traverse there.

Removing /nix/var/nix/gcroots/buildkite/canon might not be needed, and
is racy with other anchor step - the first one might still be building
`ci.gcroot` (and didn't create the new symlink), so the second one will
fail trying to remove the non-existing symlink.

Change-Id: I0449447f7193113d807d597750b26c7beb48a3a6
Reviewed-on: https://cl.snix.dev/c/snix/+/30257
Reviewed-by: Ilan Joselevich <personal@ilanjoselevich.com>
Autosubmit: Florian Klink <flokli@flokli.de>
Tested-by: besadii

ops/machines/build01/default.nix

@@ -93,6 +93,7 @@ in
     };
   systemd.tmpfiles.rules = [
     "d '/nix/var/nix/gcroots/buildkite' 0770 - buildkite-agents - -"
+    "z '/nix/var/nix/gcroots' 0771 - - - -"
   ];
 
   services.openssh.enable = true;

ops/pipelines/depot.nix

@@ -25,7 +25,6 @@ let
         label = ":anchor:";
         branches = "refs/heads/canon";
         command = ''
-          rm /nix/var/nix/gcroots/buildkite/canon
           nix-build -A ci.gcroot --out-link /nix/var/nix/gcroots/buildkite/canon
         '';