windows images: stop a non-matching display glob from poisoning the build env

Image builds have been dying with "Argument list too long" from sed, mktemp
and timeout alike -- commands whose argv is trivial, which is the tell that it
was the environment that had grown, not the arguments.

The X11 forwarding hint is looked up with `ls -t /tmp/.vmix-display-* | head -1`.
Under nullglob a non-matching pattern is removed from the command line rather
than passed through literally, so `ls -t` runs with no arguments at all and
lists the working directory instead. In a nix build that directory is the
build tree, whose newest file is nix's own env-vars dump. The result is that
VMIX_DF becomes "env-vars", the SDL branch is taken on a machine with no X at
all, and DISPLAY is exported with a slice of the env dump inside it. From that
line onward every exec in the build fails with E2BIG.

find does the same lookup without depending on how the shell treats an
unmatched pattern, and -type f keeps a stray directory out of it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117qMyjpuXsjpVAcpJbFD8g

lib/images/windows/helpers/makeImage.nix

@@ -49,7 +49,11 @@ let
     VMIX_DISPLAY="-nographic"
     ${lib.optionalString (displayArg != null) ''VMIX_DISPLAY="${displayArg}"''}
     ${lib.optionalString (displayArg == null) ''
-      VMIX_DF=$(ls -t /tmp/.vmix-display-* 2>/dev/null | head -1)
+      # find, not a glob: under nullglob a non-matching /tmp/.vmix-display-*
+      # disappears entirely, leaving `ls -t` to list the build directory and
+      # hand back nix's own env-vars dump. Exporting that as DISPLAY bloats the
+      # environment until every exec dies with E2BIG.
+      VMIX_DF=$(find /tmp -maxdepth 1 -type f -name '.vmix-display-*' -printf '%T@ %p\n' 2>/dev/null | sort -rn | head -1 | cut -d' ' -f2-)
       if [ -n "$VMIX_DF" ]; then
         export DISPLAY=$(sed -n '1p' "$VMIX_DF")
         export XAUTHORITY=$(sed -n '2p' "$VMIX_DF")