Use nix-ci image with gitea_clone_token for CI builds

The nix-ci entrypoint sets up ~/.netrc from GITEA_CLONE_TOKEN
so Nix can fetch private flake inputs like fleet-pins.

.woodpecker.yaml

@@ -5,8 +5,11 @@ when:
 steps:
   - name: build
     image: git.oleks.space/oleks/nix-ci:latest
+    environment:
+      GITEA_CLONE_TOKEN:
+        from_secret: gitea_clone_token
     commands:
-      - echo "extra-experimental-features = nix-command flakes" >> /etc/nix/nix.conf
+      - nixos-ci-entrypoint true
       - nix build .#xonsh --no-link --print-out-paths
       - nix build .#hello-world --no-link --print-out-paths
     backend_options: