feat: live ISO — nix daemon mode, autologin fix, GPU detection, app stack

- Switch nix from single-user to daemon mode (trusted-users = root live);
  Void socket at /var/nix/daemon-socket/socket confirmed
- Fix lightdm autologin: use session-wrapper=/etc/lightdm/Xsession (Void
  lightdm 1.32 has no lightdm-session binary)
- Fix session env: LIBGL_ALWAYS_SOFTWARE=1 via profile.d (session-env=
  is unsupported in this lightdm version)
- GPU auto-detection at boot: VIRT→software GL, NVIDIA PRIME offload,
  Intel/AMD/generic→modesetting
- Add nix-daemon to live runsvdir/default; remove unsupported -S mklive flag
- first-login.sh: install Claude Code + nix user packages (google-chrome,
  spotify, discord, localsend, mission-center) + NVM/node + VS Code exts
- build-live-iso.sh: write nix-packages.list from NIX_USER_PACKAGES
- postinstall.sh: fix nix-daemon socket path to /var/nix/daemon-socket/socket
- Dockerfile: add dconf-cli for build-time dconf compile
- _inner-build-live.sh: use correct 'dconf compile' API (not 'dconf update')
- .gitignore: add build/live-includes/ (generated staging tree)
- docs/LIVE_ISO.md: document all findings, gotchas and architecture

installer/first-login.sh

@@ -1,6 +1,8 @@
 #!/bin/bash
 # First-login one-shot setup for the user.
-# Installs Claude Code (official) + NVM + node LTS + vscode extensions.
+# Installs: Claude Code, NVM + node LTS, VS Code extensions,
+#           and (if NIX_PACKAGES_FILE is present) nix user packages
+#           (google-chrome, spotify, discord, localsend, mission-center).
 # Idempotent: creates ~/.first-login-done marker on success.
 
 # NOTE: do NOT use `set -u` here — nvm.sh references unbound vars.
@@ -19,8 +21,7 @@ if ! getent hosts github.com >/dev/null 2>&1; then
     exit 0
 fi
 
-# --- Claude Code (official native installer) — runs FIRST so failures in
-#     downstream NVM/node/etc. don't block claude installation. ---
+# --- Claude Code (official native installer) ---
 mkdir -p "$HOME/.local/bin"
 export PATH="$HOME/.local/bin:$PATH"
 if ! command -v claude >/dev/null 2>&1 && [[ ! -x "$HOME/.local/bin/claude" ]]; then
@@ -29,6 +30,39 @@ if ! command -v claude >/dev/null 2>&1 && [[ ! -x "$HOME/.local/bin/claude" ]];
         echo "!! claude install failed"; }
 fi
 
+# --- Nix user packages (google-chrome, spotify, discord, etc.) ---
+# Present when running from the live ISO (written by build-live-iso.sh).
+# In the installed system the packages come from first-boot-nix.sh instead.
+NIX_PACKAGES_FILE="${NIX_PACKAGES_FILE:-/usr/local/libexec/nix-packages.list}"
+if [[ -r "$NIX_PACKAGES_FILE" ]] && command -v nix >/dev/null 2>&1; then
+    echo "==> installing nix user packages from $NIX_PACKAGES_FILE"
+
+    # Source nix profile.d scripts so PATH and env are set.
+    for f in /etc/profile.d/nix*.sh; do
+        # shellcheck disable=SC1090
+        [[ -r "$f" ]] && . "$f"
+    done
+
+    # Initialise per-user nix profile if needed.
+    if [[ ! -d "$HOME/.nix-profile" ]]; then
+        nix-env --switch-profile "$HOME/.nix-profile" 2>/dev/null || true
+    fi
+
+    # D-Bus session is available when autostarted from Cinnamon.
+    if [[ -z "${DBUS_SESSION_BUS_ADDRESS:-}" ]]; then
+        eval "$(dbus-launch --sh-syntax 2>/dev/null)" || true
+    fi
+
+    export NIXPKGS_ALLOW_UNFREE=1
+
+    mapfile -t pkgs < <(grep -vE '^\s*(#|$)' "$NIX_PACKAGES_FILE")
+    if [[ ${#pkgs[@]} -gt 0 ]]; then
+        echo "    packages: ${pkgs[*]}"
+        nix profile install --impure "${pkgs[@]}" 2>&1 || {
+            echo "!! nix profile install failed (partial install may have succeeded)"; }
+    fi
+fi
+
 # --- NVM (best effort; nvm.sh has unbound vars so isolate it) ---
 if [[ ! -s "$HOME/.nvm/nvm.sh" ]]; then
     echo "==> installing NVM"
@@ -39,7 +73,6 @@ fi
 
 if [[ -s "$HOME/.nvm/nvm.sh" ]]; then
     export NVM_DIR="$HOME/.nvm"
-    # nvm.sh trips `set -u` on STABLE/PROVIDED_VERSION; isolate in subshell.
     (
         set +u
         # shellcheck disable=SC1091
@@ -51,8 +84,6 @@ if [[ -s "$HOME/.nvm/nvm.sh" ]]; then
         nvm use --lts >/dev/null 2>&1 || true
     ) || true
 
-    # Symlink the resulting node/npm into ~/.local/bin so they're on PATH
-    # for non-nvm shells.
     NODE_BIN_DIR="$(ls -d "$HOME"/.nvm/versions/node/v*/bin 2>/dev/null | sort -V | tail -1)"
     if [[ -n "$NODE_BIN_DIR" && -d "$NODE_BIN_DIR" ]]; then
         for bin in node npm npx; do

installer/lib/postinstall.sh

@@ -206,14 +206,13 @@ mark=/var/lib/first-boot-nix.done
 [[ -f "\$mark" ]] && exit 0
 
 # Wait for nix-daemon to be available.
-# The Void package puts the socket at /var/nix/daemon-socket/nix-daemon.sock
-# (NOT /nix/var/nix/...).
-for _ in \$(seq 1 30); do
-    [[ -S /var/nix/daemon-socket/nix-daemon.sock ]] && break
-    sleep 1
+# The Void xbps nix package puts the socket at /var/nix/daemon-socket/socket.
+for _ in \$(seq 1 60); do
+    [[ -S /var/nix/daemon-socket/socket ]] && break
+    sleep 2
 done
 
-if [[ ! -S /var/nix/daemon-socket/nix-daemon.sock ]]; then
+if [[ ! -S /var/nix/daemon-socket/socket ]]; then
     echo "nix-daemon not available; aborting first-boot nix install" >&2
     exit 0
 fi