What’s the difference between a reproducible binary and one they’ve built themselves? Can’t they just build it from source and check that the digests match?
Is this some kind of joke?
Installing nix on a non-nixOS computer doesn't even require root. You can even bootstrap the entirety of nixpkgs that way. That's one of the most awesome things about nix and nixpkgs.
In any event, the nix store doesn't need to be in "/nix/store" anymore: https://nixos.wiki/wiki/Nix_Installation_Guide#nix_2.0.27s_n...
If you're willing to recompile the nix interpreter and sacrifice cached binaries you don't even need namespaces or ptrace. Just
./configure --with-store-dir=xyz