Foundation: standalone activation story (work-devserver, fedora)

[jasonboukheir]

Foundation — part of #36

Goal

Rebuild the activation/management story for the two standalone-HM boxes (work-devserver, jasonbk-fedora), which have no NixOS/nix-darwin system layer to absorb anything. On these hosts "remove HM" = the my.<tool> wrapper packages (installed via modules/my/home-manager.nix → home.packages) + a few hand-written dotfiles + manual env injection.

What HM provides here that disappears

• home-manager CLI + generation/activation + automatic ~/.config symlinks (home.file / xdg.configFile).
• home.sessionVariables written into a sourced session-vars file.
• targets.genericLinux.enable — injects NIX_PROFILES/XDG_DATA_DIRS so wrapped GUI apps + their .desktop/D-Bus activation are visible to GNOME on a non-NixOS distro. Load-bearing on fedora.

Deliverable

• A nix profile install-based workflow that installs the flake-built my.<tool> wrapper packages into the user env, documented in docs/. On standalone-HM hosts the my.* namespace is effectively single-user, so host config sets my.<tool> (system = the one user) and modules/my/home-manager.nix routes each finalPackage to home.packages.
• A managed-files mechanism (small install script / systemd.tmpfiles --user / activation hook) to seed fixed-path dotfiles that can't be a /nix/store symlink — notably ~/.ssh/config (must be a real 0600 file; Fedora OpenSSH safe_path rejects the group-writable store, see programs/ssh.nix TODO home-manager#322), helium External Extensions JSON, 1Password autostart .desktop.
• Manual env injection replacing targets.genericLinux: set NIX_PROFILES/XDG_DATA_DIRS (+ corp http(s)_proxy/no_proxy, EDITOR) via ~/.config/environment.d/*.conf and the shell rcs.
• Hand-written ~/.bashrc/~/.zshrc keeping the facebook master-rc sourcing + the bash→fish exec guard. Note my.fish only ships the configured fish wrapper on PATH (baked prompt/completions/hooks); making it the actual login shell is genuinely system state, out of my.* — on these hosts that login-shell wiring stays hand-written in the rcs until cutover.

Done when

work-devserver (the headless standalone box — do it first) runs entirely off nix profile my.<tool> wrappers + hand-written rc/ssh with HM removed, and GNOME/desktop integration is verified on fedora.