refactor(nix): order let bindings

configs/nixos/modules/shell/fish/default.nix

@@ -7,13 +7,13 @@
 # fish for the primary user, configured through home-manager.
 let
   cfg = config.modules.shell.fish; # NOLINT(let_order)
-  user = config.user.name;
-  shortcuts = lib.attrByPath [ config.networking.hostName ] { } config.registry.shell-shortcut;
-  envVars = lib.attrByPath [ config.networking.hostName ] { } config.registry.env-var;
   commandsOf = shortcuts: lib.mapAttrs (_name: shortcut: shortcut.command) shortcuts;
+  shortcuts = lib.attrByPath [ config.networking.hostName ] { } config.registry.shell-shortcut;
   exportEnvVar = name: value: ''
     set -gx ${name} ${lib.escapeShellArg value}
   '';
+  envVars = lib.attrByPath [ config.networking.hostName ] { } config.registry.env-var;
+  user = config.user.name;
 in
 {
   options.modules.shell.fish = {

configs/nixos/modules/shell/pi/default.nix

@@ -9,12 +9,12 @@
 # The login credential is left unmanaged, so it survives rebuilds.
 let
   cfg = config.modules.shell.pi; # NOLINT(let_order)
-  user = config.user.name;
-  piDir = "${config.users.users.${user}.home}/.pi/agent";
   vendoredPi = pkgs.pi-coding-agent.overrideAttrs {
     src = ../../../../../third_party/pi;
     patches = [ ];
   };
+  user = config.user.name;
+  piDir = "${config.users.users.${user}.home}/.pi/agent";
 in
 {
   options.modules.shell.pi = {

configs/nixos/modules/shell/rust.nix

@@ -7,7 +7,6 @@
 # Rust tools for the primary user's shell environment.
 let
   cfg = config.modules.shell.rust; # NOLINT(let_order)
-  user = config.user.name;
   toolchain = pkgs.symlinkJoin {
     name = "rust-toolchain";
     paths = with pkgs; [
@@ -18,6 +17,7 @@ let
       rustfmt
     ];
   };
+  user = config.user.name;
 in
 {
   options.modules.shell.rust.enable =