make it possible to direnv exec . at top level

This way we don't have to be so careful about where we call `direnv
exec .` and can safely assume e.g. in scripts that we're always in the
direnv environment.

.gitlab-ci.yml

@@ -42,7 +42,7 @@ ci:
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
     - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
   script:
-    - ./bin/nix-build-and-cache ci
+    - direnv exec . nix-build-and-cache ci
 
     - direnv exec . engage
   cache:
@@ -57,7 +57,7 @@ artifacts:
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
     - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
   script:
-    - ./bin/nix-build-and-cache packages
+    - direnv exec . nix-build-and-cache packages
 
 pages:
   stage: deploy

nix/shell.nix

@@ -43,4 +43,9 @@ mkShell {
   default.propagatedBuildInputs
   ++
   default.buildInputs;
+
+  shellHook = ''
+    # Workaround for <https://github.com/NixOS/nix/issues/8355>
+    unset TMPDIR
+  '';
 }