fix(nixpak): pass the session TZ through to sandboxes

ICU takes the zone name from the /etc/localtime symlink target path. A bind
mount turns it into a plain file, which keeps the TZif data but loses the
path, so the only identifier left is the ambiguous "CST" abbreviation that
ICU reads from the file and maps to America/Chicago.

Export TZ from time.timeZone and pass TZ/TZDIR through the nixpak env
allowlist.

Assisted-by: DeepSeek Harness (deepseek-flash)

hardening/nixpaks/modules/desktop-base.nix

@@ -151,6 +151,11 @@
       "NO_AT_BRIDGE"
       "QT_QPA_PLATFORMTHEME"
       "QT_WAYLAND_DISABLE_WINDOWDECORATION"
+      # ICU takes the zone name from the /etc/localtime symlink target path, but
+      # the sandbox binds it as a plain file, leaving only the ambiguous "CST"
+      # abbreviation; pass the name from the session.
+      "TZ"
+      "TZDIR"
     ] (name: sloth.envOr name "");
   };
 }