Make nix build take gitignore into account

Right now doing nix-build inside the directory isn't idempotent since it includes result - the build doesn't actually make use of it.

Also should make it so that files that don't show up in git status won't trigger mysterious rebuilds.

This is also used in obelisk (in addition to cleanSource)