feat: declare locked NixOS development host

Declare dev, scoped sudo/SSH, workspace ownership, Git and Neovim. Lock Nixpkgs, Home Manager and the unmodified dotfiles. Deploy user files declaratively and preserve a writable Lazy lockfile. Nix formatting and pure flake evaluation pass. Full build, empty-home deployment tests and activation of this reproducibility correction are still pending; the previous account baseline is live.
2026-09-04 23:03:22 +00:00
commit 69bc45bbf0
10 changed files with 330 additions and 0 deletions
@@ -0,0 +1,15 @@
+# Nix build results and local environment state.
+/result
+/result-*
+/.direnv/
+
+# Local secrets must never be imported into Nix or committed.
+/.env
+/.env.*
+!/.env.example
+/secrets/
+
+# Editor temporary files.
+*.swp
+*.swo
+*~