fix: yazi fetcher group field, xfce package renames, enable nix-ld

Three quick known-issue fixes:

- yazi: 26.x made the fetcher `group` field required, so the git
  prepend_fetchers failed to parse and yazi fell back to presets. Add
  `group = "git"` to both entries (the git plugin's setup() only renders
  the linemode — the fetcher still needs registering here).
- file-manager: xfce.exo and the three Thunar plugins moved to top-level;
  use pkgs.xfce4-exo / pkgs.thunar-{archive-plugin,volman,media-tags-plugin}.
  Clears the eval-time deprecation warnings.
- nix-ld: enable programs.nix-ld distro-wide so foreign dynamically-linked
  binaries (downloaded tools, npx-fetched claude-code, language servers)
  run without patchelf.

Also drops the now-stale claude-code mention from the allowUnfree comment
(the ask module uses npx). nix flake check passes; xfce warnings gone.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/nixos/default.nix

@@ -20,9 +20,9 @@ in
     # DEFAULT_HOSTNAME and upstream isNixos checks (see roadmap).
     system.nixos.distroName = lib.mkDefault "Nomarchy";
 
-    # Unfree allowed distro-wide: pragmatic-desktop territory (claude-code
-    # for the menu's ask-Claude module, vendor drivers, …). The custom
-    # nixpkgs-config type can't carry a nested mkDefault; disagree with
+    # Unfree allowed distro-wide: pragmatic-desktop territory (vendor
+    # GPU/wifi drivers, firmware, fonts, …). The custom nixpkgs-config
+    # type can't carry a nested mkDefault; disagree with
     # `nixpkgs.config = lib.mkForce { allowUnfree = false; }`.
     nixpkgs.config.allowUnfree = true;
 
@@ -85,6 +85,13 @@ in
     hardware.bluetooth.enable = lib.mkDefault cfg.bluetooth.enable;
     services.blueman.enable = lib.mkDefault cfg.bluetooth.enable;
 
+    # ── Foreign binaries: nix-ld ─────────────────────────────────────
+    # An ld.so shim so dynamically-linked binaries not built for NixOS
+    # (downloaded tools, language servers, pip/npm-installed ELFs, the
+    # npx-fetched claude-code) run without manual patchelf. On by default —
+    # a pragmatic-desktop expectation.
+    programs.nix-ld.enable = lib.mkDefault true;
+
     # ── Firmware ─────────────────────────────────────────────────────
     # Blobs for in-kernel drivers: wifi (iwlwifi/ath/rtw/brcm), SOF
     # audio, Bluetooth. Drivers ship with the kernel, but without these