Reduce Arch package surface

1 files changed, 9 insertions, 10 deletions

diff --git a/README.md b/README.md
index d8e603b..2a1e88e 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ My Arch Linux configuration, managed with [chezmoi](https://www.chezmoi.io/).
 
 - **Wayland only.** No X server, no display manager. Sway starts from `exec sway` at the end of the zsh login shell on TTY1 (autologin via a host-local `getty@tty1` drop-in that's deliberately gitignored).
 - **XDG everywhere.** Every tool is pushed to `$XDG_CONFIG_HOME` / `$XDG_CACHE_HOME` / `$XDG_DATA_HOME` — `~` stays clean. Zsh itself lives under `$XDG_CONFIG_HOME/zsh`, bootstrapped by a single-line `dot_zshenv`.
-- **[sudo-rs](https://github.com/trifectatechfoundation/sudo-rs), not the C sudo.** Memory-safe Rust rewrite, drop-in CLI compatible. Same one that Ubuntu 25.10 ships as default.
+- **[sudo-rs](https://github.com/trifectatechfoundation/sudo-rs), not the C sudo.** Memory-safe Rust rewrite, drop-in CLI compatible. Exposed through user-scoped `~/.local/bin` shims instead of system-wide `/usr/local/bin` shadows.
 - **GPG for everything signable.** Commits and tags are signed; the same GPG agent also serves SSH authentication — one key, one cache, one PIN entry.
 - **Secrets via [`pass`](https://www.passwordstore.org/).** API keys and tokens are pulled into env vars at shell init; nothing is committed.
 - **Plain-text over configuration-as-code.** Packages and enabled units are tracked as one-per-line `.txt` files in `meta/` and `systemd-units/`, diffed against `pacman -Qeq` and `systemctl list-unit-files`. No DSL, no state file.
@@ -18,7 +18,7 @@ My Arch Linux configuration, managed with [chezmoi](https://www.chezmoi.io/).
 
 | Category           | Choice                                                                                                                                                                                                                                                                                        |
 | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| OS & base          | [Arch Linux](https://archlinux.org/), [paru](https://github.com/Morganamilo/paru) for AUR, [sudo-rs](https://github.com/trifectatechfoundation/sudo-rs) for privilege escalation                                                                                                              |
+| OS & base          | [Arch Linux](https://archlinux.org/) with pacman for official packages, [Nix](https://nixos.org/) / Home Manager for user-leaf tools, [sudo-rs](https://github.com/trifectatechfoundation/sudo-rs) for privilege escalation                                                                   |
 | Dotfile manager    | [chezmoi](https://www.chezmoi.io/) (dotfiles and `/etc` both deployed via `chezmoi apply`)                                                                                                                                                                                                    |
 | Task runner        | [just](https://just.systems/) — every maintenance action is a recipe (see below)                                                                                                                                                                                                              |
 | Shell              | [zsh](https://www.zsh.org/), relocated to `$XDG_CONFIG_HOME/zsh`; plugins via [zinit](https://github.com/zdharma-continuum/zinit)                                                                                                                                                             |
@@ -29,7 +29,7 @@ My Arch Linux configuration, managed with [chezmoi](https://www.chezmoi.io/).
 | Bar / launcher     | [waybar](https://github.com/Alexays/Waybar), [fuzzel](https://codeberg.org/dnkl/fuzzel)                                                                                                                                                                                                       |
 | Notifications      | [mako](https://github.com/emersion/mako)                                                                                                                                                                                                                                                      |
 | Lock screen        | [swaylock](https://github.com/swaywm/swaylock)                                                                                                                                                                                                                                                |
-| Browser            | [LibreWolf](https://librewolf.net/) (Flathub `io.gitlab.librewolf-community` for bubblewrap host-isolation), hardened via `user-overrides.js` + `userChrome.css` (kept under `firefox/` by name for recognizability)                                                                          |
+| Browser            | [LibreWolf](https://librewolf.net/) (Flathub `io.gitlab.librewolf-community` for bubblewrap host-isolation), hardened via nixpkgs' Arkenfox `user.js` + `firefox/user-overrides.js` and `userChrome.css` (kept under `firefox/` by name for recognizability)                                  |
 | Mail               | [Thunderbird](https://www.thunderbird.net/) (Flathub `org.mozilla.thunderbird`) against [ProtonMail Bridge](https://proton.me/mail/bridge) + Radicale (CalDAV/CardDAV); non-private prefs tracked under `thunderbird/`                                                                        |
 | Secrets & identity | [GPG](https://gnupg.org/) (commit signing + SSH auth via gpg-agent), [pass](https://www.passwordstore.org/)                                                                                                                                                                                   |
 | Media & viewers    | [mpv](https://mpv.io/) (Flathub `io.mpv.Mpv`; streamlink launches it via `flatpak run`), [zathura](https://pwmt.org/projects/zathura/) (Flathub `org.pwmt.zathura`), [yazi](https://yazi-rs.github.io/)                                                                                       |
@@ -56,12 +56,11 @@ curl -fsSL https://raw.githubusercontent.com/sommerfelddev/dotfiles/master/boots
 ```
 
 The script installs pacman prerequisites, enables `%wheel` in sudoers,
-builds `paru-bin` from the AUR, clones this repo to `~/dotfiles`, runs
-`just init`, enables recommended systemd units (fstrim, timesyncd,
-resolved, reflector, paccache, pkgstats, acpid, cpupower, iwd, plus tlp
-on laptops), refreshes the pacman mirrorlist, and creates XDG user
-directories. On EFI systems missing an Arch boot entry, it prints the
-`efibootmgr` command to register the UKI (run after your first
+clones this repo to `~/dotfiles`, runs `just init`, enables recommended
+systemd units (fstrim, timesyncd, resolved, reflector, paccache, pkgstats,
+acpid, cpupower, iwd, plus tlp on laptops), refreshes the pacman mirrorlist,
+and creates XDG user directories. On EFI systems missing an Arch boot entry,
+it prints the `efibootmgr` command to register the UKI (run after your first
 `mkinitcpio -P`).
 
 ## Setup on an existing system
@@ -81,7 +80,7 @@ Everything is driven by [just](https://just.systems/) recipes against four paral
 | `meta/*.txt`                        | `just pkg-apply`, `just pkg-status`                   | Plain-text package lists (one per line, `#` comments). Groups: `base`, `dev`, `wayland`, etc.                                                                                                                                                                                                                                                                                 |
 | `systemd-units/{system,user}/*.txt` | `just unit-apply`, `just unit-status`                 | Units to enable, split by scope. `system/` files pair by name with `meta/` groups (`system/base.txt` ↔ `meta/base.txt`); `user/` files are standalone. Recipe group token: `<name>` / `system:<name>` / `user:<name>`.                                                                                                                                                        |
 | `etc/`                              | `run_onchange_after_deploy-etc.sh.tmpl`               | System-level configs deployed to `/etc/` via a chezmoi onchange hook.                                                                                                                                                                                                                                                                                                         |
-| `firefox/`                          | `run_onchange_after_deploy-firefox.sh.tmpl`           | LibreWolf `user-overrides.js` + `userChrome.css` (kept under the familiar `firefox/` name).                                                                                                                                                                                                                                                                                   |
+| `firefox/`                          | `run_onchange_after_deploy-firefox.sh.tmpl`           | LibreWolf hardening: renders nixpkgs' Arkenfox `user.js` plus `firefox/user-overrides.js` into the Flatpak profile, and deploys `userChrome.css` (kept under the familiar `firefox/` name).                                                                                                                                                                                   |
 | (cartão de cidadão)                 | `run_onchange_after_deploy-pteid-pkcs11.sh.tmpl`      | Bridges the `pt.gov.autenticacao` flatpak's PKCS#11 module into the NSS DB of every flatpak that needs cartão de cidadão (LibreWolf, Thunderbird, Okular, LibreOffice) — `--filesystem` + `--socket=pcsc` override + `modutil -add` per NSS DB (per-profile for Mozilla apps, shared `~/.pki/nssdb` for Okular/LibreOffice). No-op unless `pt.gov.autenticacao` is installed. |
 | (Thunderbird native editor)         | `run_onchange_after_deploy-tb-eer.sh.tmpl`            | Bridges `external-editor-revived` (host pacman package) into the Thunderbird flatpak: deploys a `flatpak-spawn --host` wrapper into the sandbox's `~/.mozilla/native-messaging-hosts/` and rewrites the manifest `path` to point at it. No-op unless TB flatpak + EER host package are both installed.                                                                        |
 | (flatpak config sharing)            | `run_onchange_after_deploy-flatpak-overrides.sh.tmpl` | Read-only `--filesystem=xdg-config/<app>:ro` overrides so the zathura and mpv flatpaks read our chezmoi-managed `~/.config/<app>/` instead of a separate in-sandbox copy.                                                                                                                                                                                                     |