What I've been doing for now is to pre-build the container to include the Nix environment in the nix store. I still run nix in the CI so I only have to rebuild the container from time to time, when the env has changed a lot. It's certainly not an ideal solution but it works without special support.

You indeed need some kind of nix-aware runner (e.g. with a persistent /nix) if you want both the flexibility and performance...