feat(toolkit): bundle the baseline interactive toolset (task 0001)

Add modules.toolkit, an aggregator that enables fish, tmux, nvim, git,
and direnv as one unit, so any Host or Guest shell feels identical. Each
member is set via mkDefault, so a Host can still override any single
piece while the one flag brings up the whole bundle.

neogaia now enables the bundle as a single line in place of its five
individual enables, keeping the Host a flat checklist.

.claude/tasks/0001-toolkit-bundle.md

@@ -0,0 +1,23 @@
+---
+spec: guests
+---
+
+## What to build
+
+A new bundle Module, `modules.toolkit`, that turns on the baseline interactive environment — fish, tmux, nvim, git, and direnv — as one unit.
+Enabling it on a Host brings up all five together, so any Host or Guest shell feels identical.
+This is a deliberate bundle wanted as a unit, distinct from the grouping-directory aggregate enables ADR 0004 rejected.
+
+## Acceptance criteria
+
+- [x] `modules.toolkit` declares an `enable` option following the Enable convention and lives at a path its file location mirrors, per the Namespace convention.
+- [x] Enabling `modules.toolkit` turns on fish, tmux, nvim, git, and direnv as a group.
+- [x] A Host that enables `modules.toolkit` still reads as a flat checklist — the bundle is one line, not a hidden group of five.
+- [x] A Host enabling `modules.toolkit` builds via `nix flake check`, and the five underlying Modules are enabled (verifiable by `nix eval` of their `enable` values).
+
+## Implementation Notes
+
+- `modules/toolkit.nix` follows the sanctioned aggregator pattern of `modules/desktop/desktop.nix`: an index node whose `enable` sets each member's `enable = lib.mkDefault true`, so a Host can still override any single piece while the one flag brings up the bundle.
+- `neogaia` was converted as the demonstrating Host: its five individual `modules.{fish,git,direnv,tmux,nvim}.enable = true` lines collapse to one `modules.toolkit.enable = true`. The host-specific `modules.fish.defaultShell = true` stays, since it is placement beyond the bundle's baseline enable.
+- Verified: `nix flake check` builds `checks.x86_64-linux.neogaia`, and `nix eval` of each of the five members' `enable` on neogaia returns `true`.
+- The working tree also carries `.claude/CONTEXT.md`, ADR 0006, and the `guests` spec — planning artifacts for the wider `guests` spec, not this task. They are deliberately left out of this task's commit and staged separately by the broader work.

hosts/neogaia/default.nix

@@ -42,14 +42,10 @@
   # A machine the operator works from, so it admits the workstation keys alone.
   modules.ssh.authorizedKeys = config.modules.ssh.workstationKeys;
 
+  modules.toolkit.enable = true;
   # fish as the login shell.
-  modules.fish.enable = true;
   modules.fish.defaultShell = true;
 
-  modules.git.enable = true;
-  modules.direnv.enable = true;
-  modules.tmux.enable = true;
-  modules.nvim.enable = true;
   modules.agents.claude-code.enable = true;
   modules.agents.tools.gitea-axi.enable = true;
   modules.agents.pi.enable = true;

modules/toolkit.nix

@@ -0,0 +1,18 @@
+{ config, lib, ... }:
+# The baseline interactive toolset as one deliberate bundle.
+let
+  cfg = config.modules.toolkit;
+in
+{
+  options.modules.toolkit.enable =
+    lib.mkEnableOption "the baseline interactive environment — fish, tmux, nvim, git, and direnv — as one unit";
+
+  # Each piece is turned on at default priority, so a host can still override any one of them.
+  config = lib.mkIf cfg.enable {
+    modules.fish.enable = lib.mkDefault true;
+    modules.tmux.enable = lib.mkDefault true;
+    modules.nvim.enable = lib.mkDefault true;
+    modules.git.enable = lib.mkDefault true;
+    modules.direnv.enable = lib.mkDefault true;
+  };
+}