Add attic-client (s390x) and geesefs to flake-hub, rewrite CI in xonsh

Move attic-client s390x cross-compilation from building/s390x/attic-client-s390x
and geesefs from building/s390x/geesefs-s390x into flake-hub. Replace ci/build.sh
with ci/build.xsh. All packages now built and pushed to attic via the existing
Woodpecker pipeline on push to main.

flake.nix

@@ -29,6 +29,7 @@
 
       mkPackages = pkgs: {
         hello-world = pkgs.callPackage ./packages/hello-world.nix { };
+        geesefs = pkgs.callPackage ./packages/geesefs.nix { };
         xonsh = pkgs.callPackage ./packages/xonsh.nix {
           xonsh-unwrapped = import ./packages/xonsh-unwrapped.nix {
             inherit (pkgs) lib python3Packages fetchFromGitHub;
@@ -36,6 +37,65 @@
         };
       };
 
+      # Overlays needed for s390x cross-compilation of attic-client
+      s390xOverlays = [
+        # OpenSSL s390x assembly uses z10 instructions (cijne) that the
+        # nix-bootstrapped assembler doesn't recognize
+        (final: prev: {
+          openssl = prev.openssl.overrideAttrs (old: {
+            configureFlags = (old.configureFlags or [ ]) ++ [ "no-asm" ];
+          });
+        })
+        # musl doesn't support s390x long double (IBM double-double format:
+        # LDBL_MANT_DIG=106, sizeof=16). Make musl appear unavailable so
+        # busybox-sandbox-shell uses glibc static instead.
+        (final: prev: {
+          busybox-sandbox-shell = prev.busybox-sandbox-shell.override {
+            musl = prev.musl // {
+              meta = prev.musl.meta // {
+                platforms = [ ];
+              };
+            };
+          };
+        })
+        # libarchive tests fail in k8s pod sandboxes
+        (final: prev: {
+          libarchive = prev.libarchive.overrideAttrs (_: {
+            doCheck = false;
+          });
+        })
+        # nix 2.28 is a direct dependency of attic-client — disable tests
+        # and fix missing RPATH for boost/zstd/libarchive
+        (final: prev: {
+          nixVersions = prev.nixVersions // {
+            nix_2_28 = prev.nixVersions.nix_2_28.overrideAttrs (old: {
+              doCheck = false;
+              doInstallCheck = false;
+              nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ final.patchelf ];
+              postFixup = (old.postFixup or "") + ''
+                for rpath in ${final.boost}/lib ${final.zstd.out}/lib ${final.libarchive.out}/lib; do
+                  patchelf --add-rpath "$rpath" $out/bin/nix
+                  for lib in $out/lib/lib*.so; do
+                    [ -f "$lib" ] && patchelf --add-rpath "$rpath" "$lib"
+                  done
+                done
+              '';
+            });
+          };
+        })
+        # LLVM test failures in CI pod environment — override libllvm
+        # (not llvm) so it propagates through rustc bootstrap chain
+        (final: prev: {
+          llvmPackages = prev.llvmPackages // {
+            libllvm = prev.llvmPackages.libllvm.overrideAttrs (old: {
+              doCheck = false;
+              doInstallCheck = false;
+              nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ prev.gitMinimal ];
+            });
+          };
+        })
+      ];
+
       # Native builds
       native = flake-utils.lib.eachSystem buildSystems (
         system:
@@ -69,6 +129,11 @@
         builtins.map (
           target:
           let
+            targetOverlays =
+              {
+                "s390x-linux" = s390xOverlays;
+              }
+              .${target} or [];
             pkgs = import nixpkgs {
               system = "x86_64-linux";
               crossSystem.config =
@@ -78,12 +143,20 @@
                   }
                   .${target}
                 }.config;
+              overlays = targetOverlays;
             };
             packages = mkPackages pkgs;
+            crossOnlyPackages =
+              {
+                "s390x-linux" = {
+                  inherit (pkgs) attic-client;
+                };
+              }
+              .${target} or {};
           in
           {
             name = target;
-            value = packages // {
+            value = packages // crossOnlyPackages // {
               default = packages.hello-world;
             };
           }