guix: build with `_GLIBCXX_USE_DEPRECATED=0` #36269

Make the pinned repository and commit available to callers that source the
Guix prelude.

A Bitcoin Core-specific substitute server only needs to build the
packages in the guix closure at a specific time machine commit. It does
not need to build the bitcoin core binary applications.

To facilitate extracting the time-machine commit, export it as a
variable, so substitute builders (and anybody else) can re-use it by
sourcing the prelude, instead of requiring error-prone command string parsing.

Run the single-host Guix build on pull requests and master pushes.

Use the Guix installer with a cached, verified bootstrap and retain
time-machine and depends caches to avoid repeated downloads and builds.

The regular Guix builds do not evaluate the codesign manifest, so missing
imports and broken signing dependencies can go unnoticed until signing.

Realize each signing target's environment before its main build to catch
these failures without requiring signatures or signing keys.

_GLIBCXX_USE_DEPRECATED is defined by default, disable it, which saves a
few bytes worth of debug symbols.

> Defined to the value 1 by default. Not configurable. ABI-changing.
> Turning this off removes older ARM-style iostreams code, and other
> anachronisms from the API. This macro is dependent on the version of
> the standard being tracked, and as a result may give different results
> for different -std options.

See: https://gcc.gnu.org/onlinedocs/libstdc++/manual/using_macros.html.