doc: Use 'guix environment --no-grafts' to debug build failures.

* doc/guix.texi (Debugging Build Failures): Pass --no-grafts to 'guix
environment' and explain.

doc/guix.texi

@@ -5329,7 +5329,7 @@ a container similar to the one the build daemon creates:
 $ guix build -K foo
 @dots{}
 $ cd /tmp/guix-build-foo.drv-0
-$ guix environment -C foo --ad-hoc strace gdb
+$ guix environment --no-grafts -C foo --ad-hoc strace gdb
 [env]# source ./environment-variables
 [env]# cd foo-1.2
 @end example
@@ -5337,7 +5337,10 @@ $ guix environment -C foo --ad-hoc strace gdb
 Here, @command{guix environment -C} creates a container and spawns a new
 shell in it (@pxref{Invoking guix environment}).  The @command{--ad-hoc
 strace gdb} part adds the @command{strace} and @command{gdb} commands to
-the container, which would may find handy while debugging.
+the container, which would may find handy while debugging.  The
+@option{--no-grafts} option makes sure we get the exact same
+environment, with ungrafted packages (@pxref{Security Updates}, for more
+info on grafts).
 To get closer to a container like that used by the build daemon, we can
 remove @file{/bin/sh}: