chore: replace android cross-rs cross compilation setup with a nix based one

[Dzejkop]

Rationale

The Android build requires nargo as a build-time host tool. cross-rs uses target-specific Docker images and may execute target binaries under emulation—for example, its i686-linux-android image uses an i386 QEMU runner. Noir does not publish nargo binaries for these emulated target environments, so we cannot reliably provision it inside the cross-rs build flow.

This PR replaces cross-rs with Nix-based cross-compilation. Cargo and nargo now run on the host architecture, where an official nargo binary is available, while the pinned Android NDK cross-compiles the native library for each Android target.

Changes

• Adds pinned Nix development shells for Android, wasm, and general Rust development.
• Packages the official nargo binaries for supported host platforms.
• Replaces the Android release workflow's cross-rs builds with Nix/NDK builds for:
  • aarch64-linux-android
  • armv7-linux-androideabi
  • x86_64-linux-android
  • i686-linux-android
• Consolidates local and CI Kotlin assembly through kotlin/build_kotlin.sh.
• Adds a Docker-based Nix CLI proxy for contributors without Nix. It uses linux/amd64 because the Android NDK does not provide an aarch64-linux host toolchain.
• Leaves the Swift release flow on its existing macOS/Xcode host toolchain.

Validation

• All four Android native targets built successfully in the temporary branch workflow: https://github.com/worldcoin/walletkit/actions/runs/29082146903
• Verified the Android devshell provides the pinned Rust toolchain, NDK/linkers, nargo, and JDK 17.
• Verified the release workflow retains publishing behavior while using the Nix Android build path.

---

Note

Medium Risk
This changes how release Android .so artifacts are produced; Swift is untouched, but a toolchain regression would affect published Kotlin packages until caught in CI.

Overview
Replaces cross-rs Android builds with Nix devshells so cargo and nargo run on the host while a pinned NDK r27 cross-compiles all four Android targets—addressing missing nargo binaries inside cross’s emulated target images.

Adds a flake (default, android, wasm shells), repackaged nargo, helpers (nix/build-android.sh, nix/docker.sh), and docs in nix/README.md. Cross.toml is removed; Android link flags stay in .cargo/config.toml.

Release workflow (prepare-kotlin / publish-kotlin) now installs Nix, caches Cargo artifacts, builds via ./nix/build-android.sh, and assembles JNI + UniFFI through kotlin/build_kotlin.sh --artifacts-dir. Swift release steps stay on macOS/Xcode; GitHub Actions are pinned to commit SHAs.

kotlin/build_kotlin.sh is unified for local and CI (plain cargo build, optional prebuilt .so layout). README and local_kotlin.sh drop Docker/cross prerequisites in favor of nix develop .#android.

^{Reviewed by Cursor Bugbot for commit f5bfdb4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[semgrep-code-worldcoin]

Semgrep found 10 github-actions-mutable-action-tag findings:

• .github/workflows/build-kotlin-nix.yml
  • L29 - Triage
  • L32 - Triage
  • L35 - Triage
  • L47 - Triage
  • L60 - Triage
  • L63 - Triage
  • L66 - Triage
  • L69 - Triage
  • L75 - Triage
  • L101 - Triage

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.