Fix nix single-user mode for live ISO and installer

- Store ownership: chown -R 1000:1000 at Docker build time (not runtime)
  so the live user can create lock files without flooding the tmpfs overlay
- nix.conf: add build-users-group= to force single-user mode and avoid
  daemon connection attempts (xbps nix-daemon v2.30.2 incompatible with
  pre-baked nix v2.34.6)
- profile.d: export NIX_REMOTE=local and NIXPKGS_ALLOW_UNFREE=1; wrap nix()
  to append --impure so flake installs work without extra flags
- Skel: add ~/.config/nixpkgs/config.nix with allowUnfree=true
- postinstall.sh: fix daemon socket path (/nix/var/nix/...), write
  ~/.config/nixpkgs/config.nix for installed user
- first-login.sh: add NIX_REMOTE=local alongside NIXPKGS_ALLOW_UNFREE=1
- Remove nix-daemon from live ISO services (wrong version for pre-baked client)
- Misc: bluetooth group, package list reorg, skip vscode install for niri profile

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iso/_inner-build-niri-live.sh

@@ -73,6 +73,8 @@ if [[ -n "${NIX_PACKAGES_PREBAKE:-}" ]]; then
     echo "    staging /nix into overlay ($(du -sh /nix/store 2>/dev/null | cut -f1))"
     mkdir -p "$INCLUDE_DIR/nix"
     rsync -a /nix/ "$INCLUDE_DIR/nix/" 2>&1 | tail -1
+    # Single-user nix: the live user (uid 1000) must own the store to create lock files and new paths.
+    chown -R 1000:1000 "$INCLUDE_DIR/nix"
 
     _STORE_PROFILE=$(cat "$_NIX_CACHE/.profile-path" 2>/dev/null \
         || readlink -f /root/.nix-profile 2>/dev/null || echo "")
@@ -113,9 +115,10 @@ for ua in ("curl/8.0", "xbps/0.59.2", "Mozilla/5.0 (X11; Linux x86_64)"):
         data = urllib.request.urlopen(req, timeout=15).read()
         tf = tarfile.open(fileobj=io.BytesIO(data))
         idx = plistlib.loads(tf.extractfile("index.plist").read())
-        for pkgver, meta in idx.items():
-            if isinstance(meta, dict) and meta.get("pkgname") in want:
-                found[meta["pkgname"]] = pkgver
+        # index.plist keys are package names; pkgver field holds the versioned name
+        for pkgname, meta in idx.items():
+            if isinstance(meta, dict) and pkgname in want:
+                found[pkgname] = meta.get("pkgver", pkgname)
         if len(found) >= len(want):
             break
     except Exception: