refactor(nix): deployment in vm.nix only; host uses chezmoi for dotfiles

Per user decision: on the Arch host, chezmoi remains the single deployer
of $HOME dotfiles. nix/common.nix's xdg.configFile + sshConfig
activation + .zshenv home.file block was causing home-manager to fight
chezmoi on every nix-switch, materializing .backup files for nvim,
zellij, zsh, git, ghostty, direnv.

Resolution:

- nix/common.nix: drop the entire deployment block, drop the
  my.dotfilesPath option, drop the let..in dotfiles/link helpers.
  Module is now deployment-agnostic: only installs packages.

- nix/host.nix: drop my.dotfilesPath; explicit comment that chezmoi
  owns dotfile deployment on the host.

- nix/vm.nix: gains everything previously in common.nix's deployment
  block — xdg.configFile (nvim/zellij/zsh/git/ghostty/direnv),
  home.activation.sshConfig, home.file.".zshenv". The 'dotfiles'
  let-binding (= $HOME/.local/share/dotfiles) and 'link' helper move
  here too, since they're vm-only now.

Host runbook unchanged (`just sync`); first run after pulling will
just be a no-op nix-switch instead of a backup-file storm.

1 files changed, 4 insertions, 5 deletions

diff --git a/nix/host.nix b/nix/host.nix
index d589002..eac2a20 100644
--- a/nix/host.nix
+++ b/nix/host.nix
@@ -2,6 +2,10 @@
 
 # Arch host Home-Manager profile. Layered on top of `common.nix`; adds
 # only host-specific concerns that don't make sense on the VM.
+#
+# Dotfile deployment on the host is owned entirely by **chezmoi** (run
+# via `just apply` / `just sync`). Home-Manager here only installs
+# binaries and writes the host-only smartcard config below.
 
 {
   imports = [ ./common.nix ];
@@ -9,11 +13,6 @@
   home.username = builtins.getEnv "USER";
   home.homeDirectory = builtins.getEnv "HOME";
 
-  # The Arch host keeps its chezmoi source state at ~/dotfiles (the
-  # canonical clone location for the dotfiles repo). The VM convention
-  # of ~/.local/share/dotfiles doesn't apply here.
-  my.dotfilesPath = "${builtins.getEnv "HOME"}/dotfiles";
-
   # ── Smartcard (Yubikey) ────────────────────────────────────────────────────
   # Nix's gnupg ships its own scdaemon. Delegate to the system pcscd
   # service instead of letting nix's scdaemon open the USB device