guix: switch from guix environment to guix shell

See https://guix.gnu.org/manual/devel/en/html_node/Invoking-guix-environment.html.

> Deprecation warning: The guix environment command is deprecated
in favor of guix shell, which performs similar functions but is more
convenient to use. See Invoking guix shell.

> Being deprecated, guix environment is slated for eventual removal,
but the Guix project is committed to keeping it until May 1st, 2023.
Please get in touch with us at guix-devel@gnu.org if you would like
to discuss it.

See also https://guix.gnu.org/blog/2021/from-guix-environment-to-guix-shell/
for a blog post and additional details.

Guix shell was added to guix in this commit,
https://git.savannah.gnu.org/cgit/guix.git/commit/?id=80edb7df6586464aa40e84e103f0045452de95db
which isn't part of the 1.3.0 release binaries out of the box, but
invoking a guix pull, and updating will make it available for all
builders.

contrib/guix/libexec/codesign.sh

@@ -8,7 +8,7 @@ export TZ=UTC
 
 # Although Guix _does_ set umask when building its own packages (in our case,
 # this is all packages in manifest.scm), it does not set it for `guix
-# environment`. It does make sense for at least `guix environment --container`
+# shell`. It does make sense for at least `guix shell --container`
 # to set umask, so if that change gets merged upstream and we bump the
 # time-machine to a commit which includes the aforementioned change, we can
 # remove this line.