Wait for pending derivations before checking validity

[jacobmichels]

Why

macOS CI on main intermittently fails in flakes / provenance after the test clears its store and restores a package from a binary cache. The provenance check reports that it cannot recreate the package's .drv file (its build recipe).

A validity lookup can race with an asynchronous recipe write. The write clears the cached metadata, but an earlier lookup can finish afterward and cache a stale “missing” result. Waiting only before the final validity check is too late.

Change

In AttrCursor::forceDerivation(), wait for any queued write before the first validity lookup. Preserve regeneration for missing recipes and the second wait after regeneration. Put both waits and the validity checks inside !settings.readOnlyMode, so read-only evaluation returns the derivation path without waiting or checking its validity.

This fixes the race at this call site. The broader path-info cache race, where a lookup can cache a stale result after invalidation, remains outside this change.

Retain the deterministic regression test that completes a write between a missing-path lookup and caching its result, using a temporary local store without threads or sleeps. Add a regression test that verifies read-only evaluation returns the path without waiting for a pending write.

Checks

• nix develop -c meson compile -C build — passed.
• nix develop -c meson test -C build --no-rebuild --print-errorlogs nix-expr-tests eval-cache provenance — all three suites passed, including both regression tests.
• nix develop -c ./maintainers/format.sh — passed.

Local checks ran on Linux. macOS confirmation remains with CI.