fix(ops/pipelines): fix anchor steps

Every buildkite user needs to be able to update these symlinks, and the
directory doesn't exist. It was probably created imperatively on whitby.

Use a tmpfiles rule creating a /nix/var/nix/gcroots/buildkite directory,
and add a `canon` symlink in there.

Change-Id: Ic4d67fbb69f77cebe891b0fff9b824713ebec87c
Reviewed-on: https://cl.snix.dev/c/snix/+/30247
Tested-by: besadii
Autosubmit: Florian Klink <flokli@flokli.de>
Reviewed-by: Ilan Joselevich <personal@ilanjoselevich.com>

ops/machines/build01/default.nix

@@ -91,6 +91,9 @@ in
         group = "buildkite-agents";
       };
     };
+  systemd.tmpfiles.rules = [
+    "d '/nix/var/nix/gcroots/buildkite' 0770 - buildkite-agents - -"
+  ];
 
   services.openssh.enable = true;
   time.timeZone = "UTC";