fix: install nixpacks from its pinned GitHub release instead of ghcr.io image

ghcr.io/railwayapp/nixpacks no longer ships the nixpacks CLI binary at
/usr/bin/nixpacks (the image was repurposed upstream for something
else — confirmed while deploying to production, build failed with
"not found" for the pinned 1.41.0 tag). Download the exact release
tarball from GitHub instead, still pinned to the same version.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Dockerfile

@@ -1,6 +1,16 @@
-FROM ghcr.io/railwayapp/nixpacks:1.41.0 AS nixpacks
 FROM docker:27-cli AS dockercli
 
+FROM debian:12-slim AS nixpacks
+# ghcr.io/railwayapp/nixpacks no longer ships the CLI binary in its image (repurposed
+# upstream for something else) — pull the pinned release tarball from GitHub instead.
+ARG NIXPACKS_VERSION=1.41.0
+RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates \
+  && rm -rf /var/lib/apt/lists/* \
+  && curl -fsSL -o /tmp/nixpacks.tar.gz \
+    "https://github.com/railwayapp/nixpacks/releases/download/v${NIXPACKS_VERSION}/nixpacks-v${NIXPACKS_VERSION}-x86_64-unknown-linux-gnu.tar.gz" \
+  && tar -xzf /tmp/nixpacks.tar.gz -C /usr/bin nixpacks \
+  && rm /tmp/nixpacks.tar.gz
+
 FROM node:20-slim AS build
 WORKDIR /repo
 COPY package.json package-lock.json ./