default.nix: filter .git and unknown files in src
tiny refactoring
Let nix-build create the 'result' link in place (.nhc/result) to keep
it as a nix garbage collection root.