Replace test invocations via `nix-shell <..>` in CI with check phases and `nix-build` calls

[yfyf]

The CI now copies 100s of nix packages just to re-run a single command for kiosk or ocaml. If we specified the tests as check phases (or passthru targets) the derivation can just check if it exists in the cache and not do anything.