nix: add su to the tailscale image for taildrive's fileserver

taildrive (TestGrantCapDrive) spawns its per-user fileserver by re-execing
tailscaled under su; running as root with no su on PATH, canSU() fails and
the fallback hits assertNotRoot(), so the fileserver never starts and shares
fail with "unable to determine address for share". The released alpine
images ship busybox su; expose that applet on the nix-built head image too.

Author: kradalby

nix/images.nix

@@ -51,6 +51,18 @@ let
     done
   '';
 
+  # taildrive (TestGrantCapDrive) spawns its per-user fileserver by re-execing
+  # tailscaled under `su` (tailscale drive/driveimpl/remote_impl.go): tailscaled
+  # runs as root and sus to the share's user. With no `su` on PATH canSU() fails,
+  # the fallback hits assertNotRoot() while root, the fileserver never starts,
+  # and every share fails with "unable to determine address for share". The
+  # released alpine images ship busybox su; expose just that applet here so it
+  # does not shadow coreutils on the image PATH.
+  busyboxSu = pkgs.runCommand "busybox-su" { } ''
+    mkdir -p $out/bin
+    ln -s ${pkgs.busybox}/bin/busybox $out/bin/su
+  '';
+
   # Tailscale HEAD client + daemon + derper, built once from the pinned source.
   # Mirrors Dockerfile.tailscale-HEAD / Dockerfile.derper's `go install`.
   tailscaleHead = buildGoModule {
@@ -131,6 +143,7 @@ let
       pkgs.getent # tailscale SSH server execs `getent passwd <user>`
       pkgs.hostname # SSH tests run `hostname` on the peer over the session
       pkgs.traceroute # HA/route tests assert path via traceroute (head-only)
+      busyboxSu # taildrive sus to spawn its per-user fileserver (TestGrantCapDrive)
     ] ++ baseUserland;
     # buildLayeredImage puts every package's bin on /bin, which is on PATH, so
     # the suite resolves tailscale/tailscaled/derper/curl/ssh/... directly — no