In apply-local, we currently elevate privileges as early as possible and re-run Colmena as root. This means that all nix calls during evaluation and build are done as root, leading to issues like NixOS/nixpkgs#169193. We should only elevate privileges as needed when running the activation scripts.