feat(dotfiles): migrate flake scaffolding

flake.nix

@@ -4,23 +4,82 @@
   inputs = {
     # Base nixpkgs channel.
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+
+    # Fresher packages, reachable per-package as `unstable.<name>`.
+    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+
+    # Latest stable release, reachable per-package as `stable.<name>`.
+    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-26.05";
+
+    home-manager = {
+      url = "github:nix-community/home-manager";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # Signed AMO extensions, pinned by version and hash.
+    firefox-addons = {
+      url = "gitlab:rycee/nur-expressions?dir=pkgs/firefox-addons";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # Follows our nixpkgs so its plugins build against the same package set.
+    nixvim = {
+      url = "github:nix-community/nixvim";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # Declarative disk partitioning.
+    # Each host declares its own layout.
+    disko = {
+      url = "github:nix-community/disko";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # Upstream per-machine hardware profiles.
+    # Each host imports its own.
+    nixos-hardware = {
+      url = "github:NixOS/nixos-hardware";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # Decrypts committed secrets at activation, from an age identity on the host.
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # Themes the graphical layer from one base16 scheme.
+    # Follows our nixpkgs so it themes the same package set the host builds.
+    stylix = {
+      url = "github:danth/stylix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # Agent-ergonomic CLI for Gitea, with a home-manager module for the agent context.
+    gitea-axi = {
+      url = "git+https://git.alexion.dev/alexion/gitea-axi";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # Personal agent skills, packaged as per-skill derivations with a home-manager module.
+    skills = {
+      url = "git+https://git.alexion.dev/alexion/skills";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # CachyOS kernel and binary cache.
+    # This must not follow this flake's nixpkgs because Chaotic builds against its own pinned package set.
+    # Its cache serves the kernel only when the overlay stays on the cache-friendly path.
+    chaotic.url = "github:chaotic-cx/nyx/nyxpkgs-unstable";
   };
 
-  outputs = { nixpkgs, ... }:
-    let
-      system = "x86_64-linux";
-      pkgs = import nixpkgs {
-        inherit system;
-        config.allowUnfree = true;
-      };
-    in
+  outputs =
+    { self, nixpkgs, ... }@inputs:
     {
-      devShells.${system} = {
-        test = pkgs.mkShell {
-          shellHook = ''
-            echo "Hello world!"
-          '';
-        };
-      };
+      nixosConfigurations = (import ./src/dotfiles {
+        inherit inputs self;
+        lib = nixpkgs.lib;
+        root = ./configs/nixos;
+      }).nixosConfigurations;
     };
 }