feat: build the Skeleton and a minimal neogaia Host

Stand up the walking skeleton the rest of the laptop MVI extends and
re-verifies against: the whole neogaia Host evaluates and its system
toplevel builds (nix flake check green).

- flake.nix: hand-rolled flake (no flake-parts). Base nixos-unstable, plus
  nixpkgs-unstable and nixos-25.05 for the per-package unstable/stable
  overlays, home-manager (nixpkgs followed), and chaotic-nyx (deliberately
  not following our nixpkgs, to keep its binary cache usable). checks build
  each Host toplevel.
- lib/: trimmed helper lib — the Auto-loader (recursive .nix discovery, no
  null-placeholder hack), the host-builder, and the script-from-file helper.
  Deps inherited explicitly; no with lib.my, no nixosModules output.
- system/: shared base config — the unstable/stable overlays, the user
  option (defaults to alexion, in wheel, drives system + home-manager user
  in lockstep), flakes, git, and home-manager as a NixOS module.
- modules/example.nix: Auto-loader / Enable-convention reference Module,
  inert until enabled.
- hosts/neogaia/: minimal laptop Host — placeholder filesystems, bootloader,
  and hardware profile.
- CLAUDE.md: project agent instructions with a Gotchas section (nix on the
  CachyOS dev host, the chaotic overlay/cache behaviour, the Gitea CLI).

system/default.nix

@@ -0,0 +1,84 @@
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}:
+# The Skeleton's shared base config: the pieces every Host carries regardless of
+# which Modules it enables — overlays, the `user`, flakes, and home-manager.
+let
+  inherit (lib) mkOption types;
+  user = config.user;
+
+  # Instantiate an extra nixpkgs source for the same platform as the base pkgs.
+  pinArgs = prev: {
+    inherit (prev.stdenv.hostPlatform) system;
+    config.allowUnfree = true;
+  };
+in
+{
+  options.user = {
+    name = mkOption {
+      type = types.str;
+      default = "alexion";
+      description = ''
+        The primary interactive user this Host is built for. An explicit option
+        with no impure environment lookup, so the config is reproducible and
+        honest about who the user is. Drives both the system account and the
+        home-manager user in lockstep.
+      '';
+    };
+    description = mkOption {
+      type = types.str;
+      default = "Alexion";
+      description = "Human-readable description (GECOS field) for the primary user.";
+    };
+  };
+
+  config = {
+    # Base is nixos-unstable; reach a package fresher with `unstable.<name>` or
+    # pin it rock-solid with `stable.<name>`. chaotic's overlay is added by its
+    # own NixOS module, imported by the host-builder.
+    nixpkgs.overlays = [
+      (_final: prev: {
+        unstable = import inputs.nixpkgs-unstable (pinArgs prev);
+        stable = import inputs.nixpkgs-stable (pinArgs prev);
+      })
+    ];
+    nixpkgs.config.allowUnfree = true;
+
+    # Flakes + a baseline so `nixos-rebuild switch` works from the console.
+    nix.settings.experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+    environment.systemPackages = [ pkgs.git ];
+
+    # Primary user, in wheel. The bootstrap password is set by hand at install
+    # time and never committed; moving it to a sops-backed hashedPasswordFile is
+    # the first post-boot task (out of scope for the MVI).
+    users.users.${user.name} = {
+      isNormalUser = true;
+      description = user.description;
+      extraGroups = [ "wheel" ];
+    };
+
+    # home-manager as a NixOS module: one `nixos-rebuild switch` builds the
+    # system and the user environment atomically, sharing the system's pkgs
+    # (with our overlays) and installing user packages into the system profile.
+    home-manager = {
+      useGlobalPkgs = true;
+      useUserPackages = true;
+      extraSpecialArgs = {
+        inherit inputs;
+        my = inputs.self.lib;
+      };
+      users.${user.name} = {
+        home.username = user.name;
+        home.homeDirectory = "/home/${user.name}";
+        home.stateVersion = "25.05";
+      };
+    };
+  };
+}