Timestamp verification skip is no longer needed (not sure why). Generally we
better off always using the environment hack for all packages because that
ensures all NIX_* flags are correctly applied.
One possible improvement in future is to filter only NIX_* variables to
passthru in Bazel.
* Skip verifying checksums for already fetched packages.
Needed for two-staged building in Nix:
1. Build a fixed derivation with `bazel fetch` (filtered out of non-reproducable bits).
2. Build an actual derivation which uses fetched dependencies (skipping
checksums needed here because they depend on the build directory).
* Don't clean environment variables for children processes.
Needed for Nix compiler wrappers.
