fix: nix profile circular symlink, mdns hang, deprecated install command

- first-login.sh: remove nix-env --switch-profile (caused .nix-profile->
  .nix-profile circular symlink, breaking all nix profile commands and
  causing ELOOP on any exec via nix PATH including xz/tar/node)
- first-login.sh: add circular symlink guard before nix profile add
- first-login.sh: nix profile install -> nix profile add (deprecated alias)
- live-setup.sh: strip mdns from nsswitch.conf hosts line at boot (no
  libnss_mdns/Avahi in live; caused first-login DNS hang)
- docs/LIVE_ISO.md: document all three issues and their fixes

installer/first-login.sh

@@ -43,9 +43,16 @@ if [[ -r "$NIX_PACKAGES_FILE" ]] && command -v nix >/dev/null 2>&1; then
         [[ -r "$f" ]] && . "$f"
     done
 
-    # Initialise per-user nix profile if needed.
-    if [[ ! -d "$HOME/.nix-profile" ]]; then
-        nix-env --switch-profile "$HOME/.nix-profile" 2>/dev/null || true
+    # Guard: nix-env --switch-profile creates a circular symlink when given
+    # ~/.nix-profile as the target (it points to itself).  Remove it so
+    # 'nix profile add' can initialise a clean profile.
+    if [[ -L "$HOME/.nix-profile" ]]; then
+        _target=$(readlink "$HOME/.nix-profile")
+        if [[ "$_target" == ".nix-profile" || "$_target" == "$HOME/.nix-profile" ]]; then
+            echo "    removing circular .nix-profile symlink"
+            rm -f "$HOME/.nix-profile"
+        fi
+        unset _target
     fi
 
     # D-Bus session is available when autostarted from Cinnamon.
@@ -58,8 +65,9 @@ if [[ -r "$NIX_PACKAGES_FILE" ]] && command -v nix >/dev/null 2>&1; then
     mapfile -t pkgs < <(grep -vE '^\s*(#|$)' "$NIX_PACKAGES_FILE")
     if [[ ${#pkgs[@]} -gt 0 ]]; then
         echo "    packages: ${pkgs[*]}"
-        nix profile install --impure "${pkgs[@]}" 2>&1 || {
-            echo "!! nix profile install failed (partial install may have succeeded)"; }
+        # 'nix profile install' is deprecated as of nix 2.x — use 'nix profile add'
+        nix profile add --impure "${pkgs[@]}" 2>&1 || {
+            echo "!! nix profile add failed (partial install may have succeeded)"; }
     fi
 fi