feat: complete and visually audit the Hyprland workstation

Refresh system/tool pins, install official Element Nightly, expand development tools, and finish desktop workflows with a shared charcoal/gold design. Retain host-specific updates and NixOS recovery generations.

update-system.sh

@@ -1,5 +1,12 @@
-# Run as dev; privileged activation uses the already declared scoped sudo rule.
-repo=${NIXOS_CONFIG_REPO:-/etc/nixos}
+# Host and activation policy come from the host's systemd unit, never inference
+# from a login name. Physical builds are staged for next boot; EC2 switches live.
+repo=${NIXOS_CONFIG_REPO:?Set NIXOS_CONFIG_REPO}
+host=${NIXOS_UPDATE_HOST:?Set NIXOS_UPDATE_HOST}
+mode=${NIXOS_UPDATE_MODE:?Set NIXOS_UPDATE_MODE}
+case "$host:$mode" in
+  dev:switch|nixos:boot) ;;
+  *) echo "Refusing unsupported update target/policy: $host:$mode" >&2; exit 2 ;;
+esac
 state=${CACHE_DIRECTORY:-/var/cache/nixos-update}
 mkdir -p "$state"
 exec 9>"$state/lock"
@@ -11,7 +18,10 @@ if [ -n "$(git status --porcelain)" ]; then
   exit 0
 fi
 baseline=$(git rev-parse HEAD)
-branch=$(git symbolic-ref HEAD)
+if ! branch=$(git symbolic-ref -q HEAD); then
+  echo 'Skipping automatic update: checkout is detached.'
+  exit 0
+fi
 work=$(mktemp -d "$state/work.XXXXXXXX")
 cleanup() {
   git -C "$repo" worktree remove --force "$work" >/dev/null 2>&1 || true
@@ -29,32 +39,48 @@ if git diff --quiet -- flake.lock; then
 fi
 nix flake check --no-build --no-update-lock-file
 nix build .#checks.x86_64-linux.updates .#checks.x86_64-linux.desktop-config \
+  .#checks.x86_64-linux.physical-config .#checks.x86_64-linux.tools \
+  .#checks.x86_64-linux.desktop-actions \
   --no-update-lock-file --no-link
 git add flake.lock
 git -c user.name='NixOS Updater' -c user.email='nixos-updater@localhost' \
   commit -m 'chore: update NixOS package inputs'
-built=$(nix build .#nixosConfigurations.dev.config.system.build.toplevel \
+built=$(nix build ".#nixosConfigurations.$host.config.system.build.toplevel" \
   --no-update-lock-file --no-link --print-out-paths)
 candidate=$(git rev-parse HEAD)
 
 # Never overwrite work started while the candidate was building.
 cd "$repo"
-if [ "$(git rev-parse HEAD)" != "$baseline" ] || \
-   [ "$(git symbolic-ref HEAD)" != "$branch" ] || \
-   [ -n "$(git status --porcelain)" ]; then
+unchanged() {
+  [ "$(git rev-parse HEAD)" = "$baseline" ] &&
+  [ "$(git symbolic-ref -q HEAD)" = "$branch" ] &&
+  [ -z "$(git status --porcelain)" ]
+}
+if ! unchanged; then
   echo 'Configuration changed during the build; leaving it untouched.'
   exit 0
 fi
-previous=$(readlink -f /run/current-system)
+if [ "$mode" = boot ]; then
+  # Preserve an already staged generation on failure, not just the running one.
+  previous=$(readlink -f /nix/var/nix/profiles/system)
+else
+  previous=$(readlink -f /run/current-system)
+fi
 sudo "$built/sw/bin/nixos-rebuild" dry-activate --no-reexec --store-path "$built"
+if ! unchanged; then
+  echo 'Configuration changed during dry activation; leaving it untouched.'
+  exit 0
+fi
 git merge --ff-only "$candidate"
-if ! sudo "$built/sw/bin/nixos-rebuild" switch --no-reexec --store-path "$built"; then
-  echo 'Activation failed; restoring the previous system. See the journal.' >&2
-  sudo "$previous/sw/bin/nixos-rebuild" switch --no-reexec --store-path "$previous"
+if ! sudo "$built/sw/bin/nixos-rebuild" "$mode" --no-reexec --store-path "$built"; then
+  echo 'Activation failed; restoring the previous system/profile. See the journal.' >&2
+  sudo "$previous/sw/bin/nixos-rebuild" "$mode" --no-reexec --store-path "$previous"
   if [ "$(git rev-parse HEAD)" = "$candidate" ] && [ -z "$(git status --porcelain)" ]; then
     git -c user.name='NixOS Updater' -c user.email='nixos-updater@localhost' \
       revert --no-edit "$candidate"
   fi
   exit 1
 fi
+printf '%s %s %s\n' "$(date -Is)" "$candidate" "$built" > "$state/last-success"
+echo "Updated $host ($mode): $built"
 # No forced reboot or garbage collection: recovery generations are retained.