feat(MM-66): add Docker image derived from Nix build #9

Summary#

Adds nix/docker.nix — a standalone buildLayeredImage derivation for the relay binary, including sqlite runtime, CA certificates, and timezone data
Extends flake.nix to expose packages.{aarch64,x86_64}-linux.docker-image using pkgs.lib.optionalAttrs pkgs.stdenv.isLinux; the Darwin package outputs are unchanged
Updates CLAUDE.md with the nix build .#docker-image command (Linux-only caveat) and documents the new nix/ directory in the project structure
Adds tests/verify-mm66.sh — automated verification script for AC1.3 (docker-image absent on Darwin) and AC3.4 (nix/docker.nix tracked by git)

nix eval confirms docker-image present for aarch64-linux and x86_64-linux
nix eval confirms docker-image absent for aarch64-darwin and x86_64-darwin (AC1.3)
git ls-files nix/docker.nix returns the file (AC3.4)
bash tests/verify-mm66.sh passes
Linux verification required: see docs/test-plans/2026-03-08-MM-66.md for the full human test plan (AC2.1–AC5.1 require a Linux system with Docker)