feat(live): the live ISO gets a desktop — browser, office, editor — for +41 MiB

BACKLOG #103. Bernardo, live ISO 2026-07-14: still no browser, no office —
"that makes a live iso useful". He is right, and it is the thing a user judges
the distro by before installing, and what they boot to rescue a machine that
won't start. It could do neither.

The live HM user now names its own set: chromium, libreoffice-fresh,
gnome-text-editor, amberol, snapshot. Firefox deliberately excluded (Bernardo's
call): chromium already owns the HTTP mime default and ships in the installed
template, so it is the browser that matches what a user gets post-install.

I asked him to choose on a "~+2 GB" premise. The premise was wrong, and
measuring rather than assuming is what corrected it: system.extraDependencies
ALREADY pins the template's HM closure into the ISO for offline installs, so
chromium/libreoffice/amberol were already in the image's store — merely absent
from the live user's profile, so nothing put them on PATH or in the launcher.
The live and template chromium resolve to the SAME store path, verified, so
reusing the template's exact `chromium.override { enableWideVine = true; }`
costs zero; a plain `chromium` would have been a second 2.5 GiB closure. Only
gnome-text-editor and snapshot are new: 9 paths, 133 MiB uncompressed. His
Firefox call still held for the right reason — it was the one item genuinely
unpinned.

V2. Measured ISO delta, both built from the same tree — the item's pass
condition: 8.038 → 8.078 GiB = +41.2 MiB (+0.50%). New
checks.live-baseline-apps asserts each app is on PATH *and* has a .desktop the
launcher can see (a binary without one is invisible, which is the failure that
matters), that HTTPS resolves to a chromium entry actually PRESENT (#94's exact
trap — a mime default naming a package nothing ships), and that firefox has not
crept back, since that is a size decision not a drive-by. The guard was proved
to fail: dropping snapshot makes it name the missing entry. flake check,
live-install-entry, option-docs, template-sot green.

V3 pending: that the apps LAUNCH needs hardware — queued on the Acer M5-481T,
from the launcher only, since that is the claim a file-level check cannot make.

Also filed, from measuring the 8 GiB rather than speculating about it:
  * #120 (NEXT, Bernardo's call) — a netinstall ISO beside the offline one.
    Starts from numbers: the offline pin is only 4.02 of 18.03 GiB uncompressed
    (~22%), so dropping it still leaves a 14 GiB desktop (~6.3 GiB compressed).
    "No pin" is not the lighter ISO; and without a binary cache for Nomarchy's
    own outputs a netinstall trades a download for a from-source install.
  * #121 — the Widevine wrapper drags a SECOND 687 MiB unwrapped chromium in
    for its share/applications alone. Pre-existing, on every installed machine.
  * #119 — text/plain names vscode, which the live ISO never ships.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

flake.nix

@@ -559,6 +559,62 @@
           # sheet to ✖/exit-1 and names the unit; with the failure
           # cleared it reports healthy/exit-0. Minimal node (just the
           # package) — the disk/flake/snapper checks self-skip in a VM.
+          # Live-ISO baseline apps (ROADMAP § live-ISO baseline apps, #103).
+          # The live session shipped no
+          # browser and no office for as long as it existed — the thing a user
+          # judges the distro by before installing, and boots to rescue a dead
+          # machine. Nothing in a build fails when an app silently leaves the
+          # live profile (it just stops being in the launcher, which is
+          # invisible until someone boots the ISO on real hardware and looks),
+          # so assert both halves: on PATH *and* a .desktop the launcher can
+          # see. Same artifacts the ISO ships, no ISO build.
+          live-baseline-apps =
+            let
+              liveHm =
+                self.nixosConfigurations.nomarchy-live.config.home-manager.users.${username};
+              gen = liveHm.home.activationPackage;
+            in
+            pkgs.runCommand "nomarchy-live-baseline-apps"
+              { nativeBuildInputs = [ pkgs.gnugrep pkgs.findutils ]; }
+              ''
+                set -euo pipefail
+                apps=${gen}/home-path/share/applications
+                bins=${gen}/home-path/bin
+
+                # Binary + launcher entry for each baseline app. The .desktop
+                # is what makes it discoverable — VISION's "discoverable
+                # without reading the README" — so a bin without one fails.
+                for d in chromium-browser.desktop \
+                         startcenter.desktop writer.desktop calc.desktop \
+                         impress.desktop \
+                         org.gnome.TextEditor.desktop \
+                         io.bassi.Amberol.desktop \
+                         org.gnome.Snapshot.desktop; do
+                  test -f "$apps/$d" || { echo "live-baseline-apps: MISSING launcher entry $d"; exit 1; }
+                done
+
+                for b in chromium libreoffice gnome-text-editor amberol snapshot; do
+                  test -x "$bins/$b" || { echo "live-baseline-apps: MISSING binary $b"; exit 1; }
+                done
+
+                # HTTP must still resolve to the browser that is actually
+                # present (#94: mime named chromium while nothing shipped it,
+                # so GIO silently skipped the entry and the live session had
+                # no default browser at all).
+                mimes=${gen}/home-files/.config/mimeapps.list
+                grep -q '^x-scheme-handler/https=chromium-browser.desktop' "$mimes"
+                test -f "$apps/chromium-browser.desktop"
+
+                # Firefox is deliberately absent — a second browser is the one
+                # item in #103's list that costs a real closure, and chromium
+                # owns the mime default (Bernardo 2026-07-14). If it ever
+                # ships here, that is a size decision, not a drive-by.
+                test ! -f "$apps/firefox.desktop" || { echo "live-baseline-apps: firefox reappeared — size decision, see #103"; exit 1; }
+
+                echo "live-baseline-apps: ok — browser, office, editor, music, camera on PATH + in the launcher"
+                touch $out
+              '';
+
           # Live-ISO install affordance (BACKLOG #57): desktop entry baked
           # into the live host's HM generation + installer on PATH + Tools
           # menu gate in nomarchy-menu. Builds the real nomarchy-live HM
@@ -1758,16 +1814,44 @@
             home-manager = {
               useGlobalPkgs = true;
               useUserPackages = true;
-              users.${username} = {
+              users.${username} = { pkgs, ... }: {
                 imports = [ self.homeModules.nomarchy ];
                 nomarchy.stateFile = ./theme-state.json;
-                # Deliberate live-session posture (BACKLOG #94): the live
-                # desktop ships the distro modules only — NO browser or
-                # template app suite (mime defaults still name chromium,
-                # which GIO skips while absent). The template's Chromium +
-                # apps arrive with installation (the ISO pins that HM
-                # closure for offline installs); #103 adds a baseline app
-                # set to the live session itself.
+
+                # Live-session baseline apps (ROADMAP § live-ISO baseline
+                # apps, #103). Until now the
+                # live desktop shipped the distro modules only — no browser,
+                # no office — which is what a user judges the distro by before
+                # installing, and what they boot to rescue a machine that
+                # won't start. Terminal tooling (yazi, btop) plus zathura/imv
+                # already ride along with the modules; this adds the GUI apps
+                # a non-Nix user reaches for.
+                #
+                # These cost almost NOTHING on the ISO: system.extraDependencies
+                # below already pins the template's HM closure for offline
+                # installs, so chromium/libreoffice-fresh/amberol are in the
+                # image's store either way — they were merely absent from the
+                # live user's profile, so nothing put them on PATH or in the
+                # launcher. Reuse the template's EXACT derivations and the
+                # store paths are shared; a plain `chromium` (no override)
+                # would be a second full browser build instead.
+                #
+                # Firefox is deliberately NOT here (Bernardo 2026-07-14):
+                # Chromium already owns the HTTP mime default and ships in the
+                # installed template, so it is the browser that matches what a
+                # user gets after installing — and a second browser is the one
+                # item in #103's list that would cost a real closure. It stays
+                # a template opt-in for installed machines.
+                home.packages = with pkgs; [
+                  # Same override as templates/downstream/home.nix — must
+                  # match exactly to share the store path (Widevine DRM;
+                  # unfree CDM, allowUnfree is on for this system).
+                  (chromium.override { enableWideVine = true; })
+                  libreoffice-fresh   # documents/sheets/slides off a dying disk
+                  gnome-text-editor   # the maintained gedit successor
+                  amberol             # music player (also in the template)
+                  snapshot            # camera — the maintained Cheese successor
+                ];
               };
             };