nixos-install: Run in a separate UTS namespace

This prevents the activation script from clobbering our hostname.
nixos-container: Ensure umask 022

Fixes #2585.