fix(installer): wire HM as a NixOS module, move env-update to system layer

The post-install standalone HM activation kept failing in new ways
(daemon access, git ownership, missing PATH on first boot). Wire HM as
a NixOS module in the generated flake instead, so first-boot dotfiles
are activated by `nixos-install` itself with proper system context. The
standalone `homeConfigurations.<user>` is kept alongside for fast
iteration via `nomarchy-env-update`. Also:

- Drop the chroot HM activation block from the installer entirely.
- Move `nomarchy-env-update` from `features/scripts/utils/` to
  `core/system/scripts/` so it ships in `nomarchy-system-scripts` and
  exists on a freshly-installed system regardless of HM state.
- Set system-wide git `safe.directory` for /etc/nixos and the
  impermanence-relocated /persist/etc/nixos so the user-mode HM run
  doesn't trip on the root-owned flake repo.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

features/scripts/utils/nomarchy-env-update

@@ -1,37 +0,0 @@
-#!/usr/bin/env bash
-
-# Nomarchy Environment Update Script
-# 1. Runs the pre-flight state migration
-# 2. Applies user-level Home Manager changes (Standalone)
-
-set -e
-
-# Detect the repository location
-if [ -f "/etc/nixos/flake.nix" ]; then
-    REPO_DIR="/etc/nixos"
-elif [ -f "/etc/nomarchy/flake.nix" ]; then
-    REPO_DIR="/etc/nomarchy"
-else
-    echo "Error: Nomarchy flake repository not found in /etc/nixos or /etc/nomarchy."
-    exit 1
-fi
-
-# Use the pre-flight migration script to ensure the state is synced before evaluation
-if command -v nomarchy-preflight-migration >/dev/null 2>&1; then
-    nomarchy-preflight-migration
-fi
-
-# Apply Home Manager changes from the local flake (Standalone).
-# On a freshly-installed system where the installer's HM activation failed,
-# `home-manager` won't be on PATH yet — fall back to `nix run` so this
-# script can recover the install instead of erroring on a missing binary.
-echo "Applying user-level changes from $REPO_DIR#$USER..."
-if command -v home-manager >/dev/null 2>&1; then
-    home-manager switch --flake "$REPO_DIR#$USER" --impure
-else
-    nix --extra-experimental-features 'nix-command flakes' \
-        run 'home-manager/release-25.11' \
-        -- switch --flake "$REPO_DIR#$USER" --impure
-fi
-
-echo "Environment update complete."