ci: disable aliases in CI's pkgs instance

This ensures we don't accidentally use aliases in the nixpkgs shell or
other places that depend on the CI-pinned pkgs instance.

Nixpkgs generally — and CI specifically — do not use aliases, because we
want to ensure they are not load-bearing and can be removed safely.

See: https://github.com/NixOS/nixpkgs/blob/ce9979ec1c/pkgs/top-level/release-outpaths.nix#L28
(cherry picked from commit f646e56d7a)

ci/default.nix

@@ -17,7 +17,12 @@ let
     else
       nixpkgs;
 
-  pkgs = import nixpkgs' { inherit system; };
+  pkgs = import nixpkgs' {
+    inherit system;
+    # Nixpkgs generally — and CI specifically — do not use aliases,
+    # because we want to ensure they are not load-bearing.
+    allowAliases = false;
+  };
 
   fmt =
     let