Set the global nix-path from the declarative NIX_PATH list so a clean environment resolves the same locked Nixpkgs. Keep old root channel profiles for recovery rather than deleting them to silence the activation warning.
Declare dev, scoped sudo/SSH, workspace ownership, Git and Neovim. Lock Nixpkgs, Home Manager and the unmodified dotfiles. Deploy user files declaratively and preserve a writable Lazy lockfile.
Nix formatting and pure flake evaluation pass. Full build, empty-home deployment tests and activation of this reproducibility correction are still pending; the previous account baseline is live.