revert(pkgs): leave the duplicate chromium — honestly, and with the numbers

Bernardo on #121 (shipped in 0b464af): "Let's leave it honestly. Sounds too
much work for a negligible gain." Agreed, and his own reasoning is the
argument: the fix worked, but it substitutes into a buildCommand nixpkgs owns,
which couples us to wrapper internals and has a SILENT no-op failure mode —
so it also needed a permanent check, because nothing about a returning
duplicate breaks a build. That standing maintenance cost buys ~195 MiB of
download and ~19 MiB of disk. Boring beats clever at that exchange rate.

Removed the overlay and checks.chromium-single-closure. The template HM closure
is back to 9.38 GiB with the duplicate present — verified by closure, not by
reading the diff. overlays.default now carries a comment saying the duplicate
is known and deliberate, where the next person will look for it.

The ROADMAP entry stays, downgraded from ✓ to ✗ decided-against: it holds the
measurement, the approach that worked (self-contained -wv copy; repoint the
wrapper's share/* symlinks; .override composes with overrideAttrs), and the
commit to recover it from. The bug is real and worth an upstream patch — the
wrapper should take its desktop entry from the variant it wraps, which helps
every NixOS user with enableWideVine, not only us. Revisit locally if #120's
netinstall ships, since download is the one axis this moves.

What survives is worth more than the fix, and is stamped on #120: closure size
is not disk size and is not image size — measure the artifact. Removing a
687 MiB path moved the ISO by 8 KiB, because mksquashfs dedupes duplicate files
and auto-optimise-store hardlinks them. Without that caveat, #120's "drop the
pin, save 4 GiB" would have evaporated at the squashfs exactly as this did.

V0: nix flake check --no-build passes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -404,8 +404,13 @@ Design/decision records and a running log of shipped work (items marked
   decision rather than a drive-by. Proved to fail: dropping snapshot makes it
   name the missing entry. **V3 pending** — that the apps *launch* needs real
   hardware (HARDWARE-QUEUE, Acer M5-481T).
-- ✓ **One chromium, not two (#121):** found by measuring #103's ISO delta
-  rather than by anything failing — nothing *was* failing, which is the point.
+- ✗ **One chromium, not two (#121) — investigated, measured, DECIDED AGAINST
+  (Bernardo, 2026-07-14): "too much work for a negligible gain".** The bug is
+  real and the fix worked; the *gain* is what failed to survive measurement.
+  Kept as a record because the measurement is the valuable part and the next
+  person to spot the duplicate deserves the numbers rather than the discovery.
+  Found by measuring #103's ISO delta rather than by anything failing —
+  nothing *was* failing, which is the point.
   nixpkgs' chromium wrapper, with `enableWideVine = true` (what the template
   ships, for Netflix/Spotify DRM), runs the `-wv` copy but links its
   `share/*` from the **plain** unwrapped build:
@@ -413,17 +418,17 @@ Design/decision records and a running log of shipped work (items marked
   reference, so a whole second **687 MiB** chromium rode along for a directory
   of `.desktop` files nothing executes — on **every installed machine**, not
   just the ISO, for as long as chromium has been the default browser.
-  **What made a fix possible** (checked first, since it decides everything):
-  the `-wv` copy is `cp -a` of the browser and is **self-contained** — it does
-  *not* reference the plain build. Had it done so, no wrapper change could
-  drop the duplicate. Its `share/` is byte-identical, `.desktop` included, so
-  `overlays.default` moves the symlink source to the copy we already run.
-  Both paths are read back out of the wrapper's own `buildCommand`, so the
-  overlay knows nothing of nixpkgs internals beyond two strings; if upstream
-  restructures either, the match returns null and the fix **no-ops** rather
-  than breaking a build. With `enableWideVine = false` the paths are equal and
-  the substitution is identity. DRM payload verified still present in the build
-  the wrapper execs; `share/` byte-identical to stock.
+  **A fix is possible, and was proven** (prototyped in 0b464af, reverted in the
+  commit that carries this entry — recover it from there rather than
+  rediscovering it): the `-wv` copy is `cp -a` of the browser and is
+  **self-contained** — it does *not* reference the plain build (had it done so,
+  no wrapper change could drop the duplicate; check this first if you revisit).
+  Its `share/` is byte-identical, `.desktop` included, so an `overlays.default`
+  entry that repoints the wrapper's `share/*` symlinks at the copy we already
+  run removes the duplicate and nothing else — DRM payload verified still
+  present, `.desktop` byte-identical to stock, and `.override
+  { enableWideVine = true; }` composes with the overlay's `overrideAttrs`, so
+  the template needs no change.
   **What it actually saves — and the lesson, which is worth more than the fix**
   (the first pass at this claimed "−687 MiB on every install"; measuring the
   *artifact* instead of the closure killed that):
@@ -448,15 +453,20 @@ Design/decision records and a running log of shipped work (items marked
   a no-op for the offline ISO that is the default today.
   **Rule this establishes: closure size is not disk size and is not image size.
   Measure the artifact.** #120's size table is closure arithmetic and inherits
-  this caveat.
-  **The guard is load-bearing**, because a silent no-op is this fix's failure
-  mode and nothing about it breaks a build: `checks.chromium-single-closure`
-  asserts the *invariant* (exactly one full unwrapped chromium in the template
-  closure — plain or `-wv`, never both), not the mechanism, and was proved to
-  fail by neutering the overlay: it reports "found 2", names both paths, and
-  says not to "fix" it by dropping `enableWideVine`, which would silently
-  remove DRM. Worth an upstream nixpkgs patch (the wrapper should take its
-  desktop entry from the variant it wraps); the overlay is the local stopgap.
+  this caveat — it is stamped there.
+  **Why it was reverted rather than kept**, though it worked: the fix is a
+  string substitution into a `buildCommand` nixpkgs owns, so it couples us to
+  wrapper internals and its failure mode is a *silent no-op* — which meant it
+  also needed a permanent `checks.*` to assert the invariant, since nothing
+  about a returning duplicate breaks a build. That is a standing maintenance
+  cost against ~195 MiB of download and ~19 MiB of disk. **Boring beats clever
+  when the gain is this small** (CONVENTIONS: prefer boring, reproducible
+  mechanisms) — so the duplicate stays, honestly, and `overlays.default` says
+  so in a comment where the next person will look.
+  **Revisit if** the netinstall (#120) ships, since download is the one axis
+  this actually moves; or better, fix it **upstream** — the wrapper should take
+  its desktop entry from the variant it wraps, which helps every NixOS user
+  with `enableWideVine`, not just us.
 - ✓ **Plymouth logo contrast:** the shipped art was a fixed navy that
   vanished on dark bases. `modules/nixos/plymouth.nix` now recolors every
   element from the palette at build time (flat fill, alpha kept):