revert(nvim)+fix(remote-dev): keep Mason authoritative, give it cargo+rustc

User policy: Mason should install everything it lists regardless of
host-provided versions. Revert the PATH-filtering wrapper around
ensure_installed (b2f129e) — back to a plain table literal.

For shellharden specifically, Mason's only install source is
`cargo install`. The Arch host has cargo via base-devel/rustup; the
VM previously didn't, so Mason errored "ENOENT cargo". Add `cargo`
and `rustc` to the remote-dev nix profile so Mason can build it on
the VM too. Drop the shellharden package from home.nix — Mason owns
it now, no more provider competition with the nix-profile binary.

2 files changed, 50 insertions, 61 deletions

diff --git a/dot_config/nvim/lua/plugins/lsp.lua b/dot_config/nvim/lua/plugins/lsp.lua
index 69f8163..1a115db 100644
--- a/dot_config/nvim/lua/plugins/lsp.lua
+++ b/dot_config/nvim/lua/plugins/lsp.lua
@@ -19,63 +19,50 @@ require("mason-lspconfig").setup({
   },
 })
 require("mason-tool-installer").setup({
-  ensure_installed = (function()
-    local tools = {
-      "actionlint",
-      "autotools-language-server",
-      "basedpyright",
-      "bash-language-server",
-      "clangd",
-      "codelldb",
-      "codespell",
-      "css-lsp",
-      "dockerfile-language-server",
-      "gh",
-      "gh-actions-language-server",
-      "groovy-language-server",
-      "hadolint",
-      "html-lsp",
-      "jq",
-      "json-lsp",
-      "jsonlint",
-      "just-lsp",
-      "lua-language-server",
-      "markdownlint",
-      "mdformat",
-      "neocmakelsp",
-      "nginx-config-formatter",
-      "nginx-language-server",
-      "npm-groovy-lint",
-      "prettier",
-      "ruff",
-      "rust-analyzer",
-      "selene",
-      "shellcheck",
-      "shellharden",
-      "shfmt",
-      "stylelint",
-      "stylua",
-      "systemd-lsp",
-      "systemdlint",
-      "taplo",
-      "typescript-language-server",
-      "typos",
-      "yaml-language-server",
-      "yamllint",
-      "yq",
-    }
-    -- Skip Mason install when the tool is already on PATH from the system
-    -- (e.g. shellharden via nix-profile on the remote-dev VM, where Mason's
-    -- cargo-build install path would fail). Mason's runners still discover
-    -- PATH binaries, so conform.nvim/nvim-lint keep working.
-    local filtered = {}
-    for _, name in ipairs(tools) do
-      if vim.fn.executable(name) ~= 1 then
-        table.insert(filtered, name)
-      end
-    end
-    return filtered
-  end)(),
+  ensure_installed = {
+    "actionlint",
+    "autotools-language-server",
+    "basedpyright",
+    "bash-language-server",
+    "clangd",
+    "codelldb",
+    "codespell",
+    "css-lsp",
+    "dockerfile-language-server",
+    "gh",
+    "gh-actions-language-server",
+    "groovy-language-server",
+    "hadolint",
+    "html-lsp",
+    "jq",
+    "json-lsp",
+    "jsonlint",
+    "just-lsp",
+    "lua-language-server",
+    "markdownlint",
+    "mdformat",
+    "neocmakelsp",
+    "nginx-config-formatter",
+    "nginx-language-server",
+    "npm-groovy-lint",
+    "prettier",
+    "ruff",
+    "rust-analyzer",
+    "selene",
+    "shellcheck",
+    "shellharden",
+    "shfmt",
+    "stylelint",
+    "stylua",
+    "systemd-lsp",
+    "systemdlint",
+    "taplo",
+    "typescript-language-server",
+    "typos",
+    "yaml-language-server",
+    "yamllint",
+    "yq",
+  },
 })
 
 vim.api.nvim_create_autocmd("LspAttach", {
diff --git a/remote-dev/home.nix b/remote-dev/home.nix
index c5dfcc7..4aeff8a 100644
--- a/remote-dev/home.nix
+++ b/remote-dev/home.nix
@@ -97,10 +97,12 @@ in
       ln -s ${pkgs.python311}/bin/python3.11 $out/bin/python3.11
     '')
 
-    # Mason fallbacks: Mason's pip/cargo installers can't run on this VM
-    # under our leaf-tools policy, so we provide these binaries on PATH and
-    # let nvim/Mason find them there instead of trying to build them.
-    shellharden
+    # Rust toolchain for Mason packages whose only install source is
+    # `cargo install` (shellharden). The host has these via the Arch
+    # package manager; on the VM Mason needs cargo+rustc on PATH or it
+    # bails with ENOENT.
+    cargo
+    rustc
 
     # AI coding agents
     claude-code