feat(pkg,nix): migrate build orchestrators + debuggers to nix; drop toolchains

Migrated to Home-Manager (nix/common.nix):

  cmake, ninja, ccache, sccache (build orchestrators — they only
    delegate to whatever compiler is on PATH, don't ship one
    themselves, so no ABI shadowing risk)
  valgrind (instruments at syscall/library boundary; works fine with
    pacman-built target binaries)
  doxygen (source-only documentation tool; was accidentally dropped
    in the previous sweep — restored here)

Dropped entirely (per-project flake.nix + direnv .envrc instead):

  clang, lld, mold, rustup, npm

  Rationale: these are language/toolchain-specific compilers and
  linkers; when a project needs them, the project's own flake provides
  the version it wants, pinned in flake.lock. base-devel still ships
  gcc/ld/as/make for general-purpose system builds and one-offs.

  npm is also dropped from pacman; nodejs_24 in nix/common.nix already
  ships npm for the editor/AI-agent path. Project-side npm comes via
  per-project flake when needed.

Updated nix/common.nix policy comment to match: only ban the actual
compilers/linkers (cc/gcc/clang/ld) and forbidden runtimes (cargo,
rustc, go, python3) — build orchestrators and instrumentation tools
are explicitly allowed.

The --- dev --- section in base.txt is now just perf and podman-*
(kernel-coupled / system-runtime-coupled).

2 files changed, 39 insertions, 31 deletions

diff --git a/meta/base.txt b/meta/base.txt
index 19407f5..2fa95f8 100644
--- a/meta/base.txt
+++ b/meta/base.txt
@@ -58,24 +58,15 @@ ell
 # direnv's source_url with a content hash, so no extra package needed.) ---
 nix
 
-# --- dev (compiler / linker / build-system / language toolchains — these
-# MUST stay on pacman: nix/common.nix is forbidden from shipping them
-# because nix-store paths on PATH would shadow the system ones and
-# silently link projects against nixpkgs glibc instead of the system
-# sysroot. See policy comment at the top of nix/common.nix.) ---
-ccache
-clang
-cmake
-lld
-mold
-ninja
-npm
-perf
+# --- dev (system-coupled runtimes only — base-devel ships gcc/ld/as/make
+# for general-purpose builds; the orchestrators (cmake/ninja/ccache/
+# sccache), debuggers and toolchain-specific compilers/linkers live in
+# nix instead. clang/lld/mold/rustup/go are intentionally absent — when
+# a project needs them, the project's flake.nix + direnv `.envrc`
+# provide them.) ---
+perf             # links against running kernel ABI; must match kernel pkg
 podman-compose
 podman-docker
-rustup
-sccache
-valgrind
 
 # --- sound ---
 alsa-utils
diff --git a/nix/common.nix b/nix/common.nix
index 091a263..46fa369 100644
--- a/nix/common.nix
+++ b/nix/common.nix
@@ -5,19 +5,26 @@
 # host and the Ubuntu remote-dev VM. Profile-specific extras live in
 # `host.nix` and `vm.nix`.
 #
-# Policy: this profile carries leaf CLI tools plus editor/AI-agent
-# runtimes (node, uv). It must NEVER carry anything the project build
-# might invoke. Forbidden on PATH (would shadow the system's and break
-# builds against the system sysroot/libc): cc, c++, gcc, g++, clang,
-# clang++, ld, ld.lld, ar, nm, objcopy, make, cmake, ninja, meson,
-# pkg-config, autoconf, automake, libtool, python, python3, pip,
-# cargo, rustc, go. If a project needs a newer toolchain, put it in a
-# project-local flake.nix + direnv `.envrc`, NOT here.
+# Policy: this profile carries leaf CLI tools, editor/AI-agent runtimes
+# (node, uv), and build *orchestrators* (cmake, ninja, ccache, sccache).
+# It must NEVER carry actual compilers or linkers — those would shadow
+# the system's and silently link projects against nixpkgs glibc/libstdc++
+# instead of the system sysroot.
 #
-# Allowed runtimes (used only by editor/AI agents): node, npm, npx
-# (via `nodejs`), uv, uvx (via `uv` — does NOT install a python3,
-# manages its own interpreters under XDG). `clang-tools` is allowed
-# because it ships only formatters/linters/clangd, no compiler driver.
+# Forbidden on PATH from this module: cc, c++, gcc, g++, clang, clang++,
+# ld, ld.lld, ar, nm, objcopy, make, meson, pkg-config, autoconf,
+# automake, libtool, python, python3, pip, cargo, rustc, go.
+#
+# Allowed: orchestrators that delegate to whatever compiler is in PATH
+# (cmake, ninja, ccache, sccache), instrumentation/analysis that hooks
+# at the syscall/library boundary (valgrind, gdb, lldb, strace), and
+# source-only tooling (doxygen, clang-tools — clangd/clang-format/
+# clang-tidy, no compiler driver). Project-specific compilers/linkers
+# go in project-local flake.nix + direnv `.envrc`, NOT here.
+#
+# Editor/AI runtimes: node, npm, npx (via `nodejs`), uv, uvx (via `uv`
+# — manages its own python interpreters under XDG, doesn't install a
+# system python3).
 
 let
   dotfiles = "${config.home.homeDirectory}/.local/share/dotfiles";
@@ -79,14 +86,24 @@ in
 
     # Debug / trace / profile — moved off pacman. User policy: only
     # used against own builds, so glibc/kernel version skew vs the
-    # system isn't an issue. `perf` and `valgrind` stay system: `perf`
-    # links against kernel ABI (pacman's matches the running kernel);
-    # `valgrind` has tighter glibc compat requirements.
+    # system isn't an issue. Only `perf` stays system (it links against
+    # the running kernel ABI; pacman's matches the kernel package).
     gdb
     lldb        # also brings lldb-dap (used by dap.lua via type="lldb")
     strace
     samply
     t-rec
+    valgrind
+
+    # Build orchestrators — these only delegate to whatever compiler is
+    # in PATH; they don't ship cc/c++/ld themselves, so no shadowing.
+    cmake
+    ninja
+    ccache
+    sccache
+
+    # Source-only docs/analysis (no compiler driver)
+    doxygen
 
     # Docs
     tldr