[ryantm]

Summary

Build strings returned by builtins.outputOf directly, including nested dynamic derivations, in native iets build and modern nix build compatibility mode.

• Carry a structured concrete producer plus ordered output chain through installables, trace-cache roots, build targets and backend jobs.
• Keep output selections per target, deduplicate complete targets, and match worker results by the complete chain and output specification.
• Upload only the original producer's closure. Resolve output paths from BuildPathsWithResults, without evaluator-time builds or wrapper derivations.
• Normalize mixed ^/! nested result paths from the daemon; reject dynamic installables on gRPC.

This PR is stacked on feat/dynamic-derivation-builds. It does not change the parent work's benchmarks.

Validation

• Real private-daemon tests cover direct and nested outputOf, fresh/cached builds, cache-hit evaluation skipping, distinct output selections, output links, dry-run/no-build, missing outputs, and modern compatibility with fallback disabled.
• Direct-string output paths match Determinate Nix 3.24.2. For nested chains, iets builds successfully and matches Nix's concrete leaf output. Determinate's own nested client fails to parse its daemon's mixed ^/! result, so that comparison uses the concrete leaf.
• Existing native build tests, classic tracing-cache tests and layering checks pass.
• Focused build/dispatcher tests and trace-wire tests pass.
• cargo clippy --all-targets -- -D warnings, cargo fmt --check, and ast-grep scan pass.
• Full library suite: 1,358 passed, 4 ignored, two filesystem-permission tests fail when run as root; both failures reproduce unchanged on the parent branch.
• Classic build suite: six pass; the remote-builder test requires kernel namespaces unavailable in this environment. The same failure reproduces on the parent branch.

Text test evidence is used here because this changes a command-line protocol, not a browser interface.

~ written by ⠕ Replit