refactor(nix): promote remote-dev/ to nix/ with common/vm/host split

Restructures the Home-Manager profile to support both the Arch host and
the Ubuntu remote-dev VM from the same flake.

  - remote-dev/ → nix/ (hard rename; .chezmoiignore updated)
  - home.nix split into common.nix (shared), vm.nix (Mason runtime
    carve-outs + podman stack), host.nix (gpg scdaemon delegation to
    system pcscd)
  - flake.nix exposes homeConfigurations.{vm,host} via a mkProfile
    helper
  - rj alias in dot_zshrc updated to ~/.local/share/dotfiles/nix
  - bootstrap.sh / justfile updated to use #vm against the new path

The split is behaviour-preserving for the VM: vm.nix + common.nix
together carry the same package set as the previous home.nix.
host.nix is provisioned but not yet wired into bootstrap (phase p8).

Phase 1 of the nix-on-host migration plan.

1 files changed, 44 insertions, 0 deletions

diff --git a/nix/flake.nix b/nix/flake.nix
new file mode 100644
index 0000000..8896f2f
--- /dev/null
+++ b/nix/flake.nix
@@ -0,0 +1,44 @@
+{
+  description = "Home-Manager profiles for the Arch host and the Ubuntu remote-dev VM.";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    home-manager = {
+      url = "github:nix-community/home-manager/master";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs = { self, nixpkgs, home-manager, ... }:
+    let
+      system = "x86_64-linux";
+      pkgs = import nixpkgs {
+        inherit system;
+        # Whitelist specific unfree packages (claude-code,
+        # github-copilot-cli) instead of globally setting allowUnfree,
+        # so a typo elsewhere can't silently pull in additional unfree
+        # deps.
+        config.allowUnfreePredicate = pkg:
+          builtins.elem (nixpkgs.lib.getName pkg) [
+            "claude-code"
+            "github-copilot-cli"
+          ];
+      };
+
+      mkProfile = module: home-manager.lib.homeManagerConfiguration {
+        inherit pkgs;
+        modules = [ module ];
+        # Path to the cloned dotfiles checkout — passed in so the
+        # modules can symlink shared configs from the same repo.
+        extraSpecialArgs = {
+          dotfilesRoot = ../.;
+        };
+      };
+    in
+    {
+      homeConfigurations = {
+        vm   = mkProfile ./vm.nix;
+        host = mkProfile ./host.nix;
+      };
+    };
+}