revert(pkgs): leave the duplicate chromium — honestly, and with the numbers

Bernardo on #121 (shipped in 0b464af): "Let's leave it honestly. Sounds too
much work for a negligible gain." Agreed, and his own reasoning is the
argument: the fix worked, but it substitutes into a buildCommand nixpkgs owns,
which couples us to wrapper internals and has a SILENT no-op failure mode —
so it also needed a permanent check, because nothing about a returning
duplicate breaks a build. That standing maintenance cost buys ~195 MiB of
download and ~19 MiB of disk. Boring beats clever at that exchange rate.

Removed the overlay and checks.chromium-single-closure. The template HM closure
is back to 9.38 GiB with the duplicate present — verified by closure, not by
reading the diff. overlays.default now carries a comment saying the duplicate
is known and deliberate, where the next person will look for it.

The ROADMAP entry stays, downgraded from ✓ to ✗ decided-against: it holds the
measurement, the approach that worked (self-contained -wv copy; repoint the
wrapper's share/* symlinks; .override composes with overrideAttrs), and the
commit to recover it from. The bug is real and worth an upstream patch — the
wrapper should take its desktop entry from the variant it wraps, which helps
every NixOS user with enableWideVine, not only us. Revisit locally if #120's
netinstall ships, since download is the one axis this moves.

What survives is worth more than the fix, and is stamped on #120: closure size
is not disk size and is not image size — measure the artifact. Removing a
687 MiB path moved the ISO by 8 KiB, because mksquashfs dedupes duplicate files
and auto-optimise-store hardlinks them. Without that caveat, #120's "drop the
pin, save 4 GiB" would have evaporated at the squashfs exactly as this did.

V0: nix flake check --no-build passes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

flake.nix

@@ -94,42 +94,11 @@
         # Includes nomarchy-what-changed (generation readability, #82).
         nomarchy-lifecycle = final.callPackage ./pkgs/nomarchy-lifecycle { };
         pam-fprint-grosshack = final.callPackage ./pkgs/pam-fprint-grosshack { };
-
-        # One chromium, not two (ROADMAP § one chromium, not two, #121).
-        # Upstream nixpkgs bug, worth a patch there: in
-        # pkgs/applications/networking/browsers/chromium/default.nix the
-        # wrapper runs the `-wv` copy when enableWideVine is set, but still
-        # links its share/ from the PLAIN unwrapped build:
-        #     for f in '${chromium.browser}'/share/*; do ln -s …
-        # A symlink is a store reference, so that retains a whole second
-        # 687 MiB chromium for a directory of .desktop files nothing runs —
-        # on every machine the template installs, not just the live ISO.
-        #
-        # Safe because the `-wv` copy is `cp -a` of the browser and is
-        # self-contained: verified it does NOT reference the plain build (had
-        # it done so, no wrapper change could drop the duplicate), and its
-        # share/ is byte-identical, .desktop included. So share moves to the
-        # copy we already run and nothing else changes.
-        #
-        # Both paths are read back out of the wrapper's own buildCommand, so
-        # this knows nothing about nixpkgs internals beyond those two
-        # strings. If upstream restructures either, the match returns null
-        # and this becomes a NO-OP rather than a broken build — and
-        # checks.chromium-single-closure is what fails, loudly, instead of
-        # the duplicate quietly returning. With enableWideVine = false the
-        # two paths are the same and the substitution is identity, so the
-        # plain package is untouched.
-        chromium = prev.chromium.overrideAttrs (old:
-          let
-            wv    = builtins.match ".*makeWrapper \"([^\"]+)/libexec/chromium/chromium\".*" old.buildCommand;
-            plain = builtins.match ".*for f in '([^']+)'/share/\\*.*" old.buildCommand;
-          in
-          prev.lib.optionalAttrs (wv != null && plain != null) {
-            buildCommand = builtins.replaceStrings
-              [ "'${builtins.head plain}'/share/" ]
-              [ "'${builtins.head wv}'/share/" ]
-              old.buildCommand;
-          });
+        # NOTE: no chromium override here on purpose — the enableWideVine
+        # wrapper's duplicate unwrapped build is a real upstream bug but is
+        # worth ~195 MiB of download and ~19 MiB of disk, not the gigabytes it
+        # looks like. Decided not to work around it locally
+        # (ROADMAP § one chromium, not two, #121).
       };
 
       nixosModules.nomarchy = {
@@ -595,43 +564,6 @@
           # sheet to ✖/exit-1 and names the unit; with the failure
           # cleared it reports healthy/exit-0. Minimal node (just the
           # package) — the disk/flake/snapper checks self-skip in a VM.
-          # One chromium, not two (ROADMAP § one chromium, not two, #121).
-          # The overlay's wrapper fix is a substitution into a string
-          # nixpkgs owns: if upstream restructures that buildCommand, the
-          # match returns null, the fix silently becomes a no-op and 687 MiB
-          # of duplicate browser quietly returns to every install. Nothing
-          # about that breaks a build — which is exactly why it needs a
-          # check. Asserts the invariant, not the mechanism: the closure the
-          # template installs carries exactly ONE full unwrapped chromium
-          # (plain OR -wv, never both; the tiny -sandbox output is a separate
-          # path and is expected).
-          chromium-single-closure =
-            let
-              hm = downstream.homeConfigurations.me.activationPackage;
-              ci = pkgs.closureInfo { rootPaths = [ hm ]; };
-            in
-            pkgs.runCommand "nomarchy-chromium-single-closure"
-              { nativeBuildInputs = [ pkgs.gnugrep ]; }
-              ''
-                set -euo pipefail
-                # Full browser builds only: -sandbox is a few KB and legitimate.
-                full=$(grep -E 'chromium-unwrapped-[0-9.]+(-wv)?$' ${ci}/store-paths || true)
-                n=$(printf '%s' "$full" | grep -c . || true)
-                if [ "$n" != 1 ]; then
-                  echo "chromium-single-closure: expected exactly 1 full unwrapped chromium, found $n:"
-                  printf '%s\n' "$full"
-                  echo
-                  echo "If this is 2, the enableWideVine wrapper is retaining the plain"
-                  echo "build for its share/* symlinks again — the overlay fix in"
-                  echo "flake.nix (ROADMAP § one chromium, not two, #121) has stopped"
-                  echo "matching upstream's buildCommand. Do NOT 'fix' it by dropping"
-                  echo "enableWideVine: that silently removes DRM playback."
-                  exit 1
-                fi
-                echo "chromium-single-closure: ok — one chromium ($full)"
-                touch $out
-              '';
-
           # Live-ISO baseline apps (ROADMAP § live-ISO baseline apps, #103).
           # The live session shipped no
           # browser and no office for as long as it existed — the thing a user