getent blocks indefinitely when the nameserver is unreachable (QEMU 10.0.2.3,
or any network where DNS responds slowly). Replace with curl --connect-timeout 3
which has a hard 3s per-attempt timeout and is independent of the NSS stack.
- first-login.sh: remove nix-env --switch-profile (caused .nix-profile->
.nix-profile circular symlink, breaking all nix profile commands and
causing ELOOP on any exec via nix PATH including xz/tar/node)
- first-login.sh: add circular symlink guard before nix profile add
- first-login.sh: nix profile install -> nix profile add (deprecated alias)
- live-setup.sh: strip mdns from nsswitch.conf hosts line at boot (no
libnss_mdns/Avahi in live; caused first-login DNS hang)
- docs/LIVE_ISO.md: document all three issues and their fixes