swarm-builder: keep only the tail of nix's output while it runs

nix_build::run read nix's stdout and stderr with read_to_end, so a long
--print-build-logs run held its whole log in memory until nix exited,
though the reply uses only the last 30 lines (4000 bytes) of stderr and
the last non-empty line of stdout. Both streams now go through a Tail
that holds at most 128 KiB and keeps the last 64 KiB. Output under 64 KiB
reaches tail() whole, so those replies are unchanged.

docs/swarm/builder.md

@@ -40,6 +40,10 @@ Where it runs and how it's enabled: [`services.md`](services.md#builder).
    The full tail is in the failed node's error on the Jobs page and in the
    builder's journal line for the build.
 
+   The builder holds the last 64 KiB of each of `nix`'s output streams while the
+   build runs, and the reply is the last 30 lines of that (at most 4000
+   bytes), so a long build log never grows its memory.
+
 ## What the check is, and isn't
 
 - It composes the config the way a hive's meta flake does