fix: yazi fetcher group field, xfce package renames, enable nix-ld

Three quick known-issue fixes:

- yazi: 26.x made the fetcher `group` field required, so the git
  prepend_fetchers failed to parse and yazi fell back to presets. Add
  `group = "git"` to both entries (the git plugin's setup() only renders
  the linemode — the fetcher still needs registering here).
- file-manager: xfce.exo and the three Thunar plugins moved to top-level;
  use pkgs.xfce4-exo / pkgs.thunar-{archive-plugin,volman,media-tags-plugin}.
  Clears the eval-time deprecation warnings.
- nix-ld: enable programs.nix-ld distro-wide so foreign dynamically-linked
  binaries (downloaded tools, npx-fetched claude-code, language servers)
  run without patchelf.

Also drops the now-stale claude-code mention from the allowUnfree comment
(the ask module uses npx). nix flake check passes; xfce warnings gone.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -350,26 +350,33 @@ close · `SUPER+1..9` workspaces · `Print` region screenshot.
   also locks hyprlock, so the user types a password twice. Lock only on
   suspend (not hibernate), or skip the hyprlock prompt when resuming from
   a LUKS-encrypted hibernate — see `modules/home/idle.nix`.
+- **Key agents & pinentry:** no SSH/GPG agent ships yet, so signing/auth
+  prompts have nowhere to go. Wire up an agent + a Wayland-native graphical
+  pinentry: `services.ssh-agent` (or gpg-agent's `enableSshSupport`),
+  `programs.gnupg.agent` with `pinentry-gnome3`/`pinentry-qt`, `SSH_AUTH_SOCK`
+  exported, and the pinentry styled from the palette where it can be. Decide
+  one-agent (gpg-agent fronting SSH) vs. two, and confirm it cooperates with
+  hyprlock/hypridle on unlock.
 
 ## Known issues & follow-ups
-- **Yazi TOML parse error on startup:** `[[plugin.prepend_fetchers]]` is
-  rejected with `missing field 'group'` (Yazi falls back to preset
-  settings). The fetcher schema gained a required `group` field; add it to
-  both git fetcher entries (e.g. `group = 0`) in `modules/home/yazi.nix:49`.
+- ✓ **Yazi TOML parse error on startup:** yazi 26.x made fetchers'
+  `group` field required, so `[[plugin.prepend_fetchers]]` failed to parse
+  and yazi fell back to presets. Fixed by adding `group = "git"` to both
+  git fetcher entries in `modules/home/yazi.nix` (the git plugin's
+  `setup()` only renders the linemode; the fetcher still needs registering).
 - **Starship prompt styling:** drop the powerline look — the current prompt
   doesn't read well. Rework the `format`/segment styling in
   `modules/home/shell.nix:59` toward a flat, plain prompt.
-- **xfce deprecation warnings:** `xfce.exo`, `xfce.thunar-archive-plugin`,
-  `xfce.thunar-volman`, `xfce.thunar-media-tags-plugin` were moved to
-  top-level. Switch to `pkgs.xfce4-exo`, `pkgs.thunar-archive-plugin`,
-  `pkgs.thunar-volman`, `pkgs.thunar-media-tags-plugin` in
-  `modules/nixos/file-manager.nix`.
+- ✓ **xfce deprecation warnings:** moved `xfce.exo` → `pkgs.xfce4-exo` and
+  the three Thunar plugins to their new top-level names in
+  `modules/nixos/file-manager.nix`; the eval warnings are gone.
 - **Rofi function keybindings:** add direct Hyprland binds for the
   `nomarchy-menu` sub-functions (calc, web search, file search, clipboard,
   …) instead of only reaching them through the menu — see the planned binds
   in the Menu-system roadmap item and `modules/home/hyprland.nix`.
-- **Enable nix-ld by default:** turn on `programs.nix-ld` distro-wide so
-  prebuilt/foreign dynamically-linked binaries run out of the box.
+- ✓ **Enable nix-ld by default:** `programs.nix-ld.enable` is on distro-wide
+  (`modules/nixos/default.nix`), so prebuilt/foreign dynamically-linked
+  binaries run out of the box.
 - **Hyprland border colors off for some themes:** the active/inactive border
   colors don't match the legacy branch for several themes — audit
   `col.active_border`/`col.inactive_border` generation in

modules/home/yazi.nix

@@ -46,9 +46,12 @@ in
         };
         plugin = {
           # git status in the linemode (fetcher registered before setup).
+          # yazi 26.x made `group` required on fetchers (without it the
+          # config fails to parse and yazi falls back to presets); "*"
+          # matches files, "*/" dirs, so they share the "git" group.
           prepend_fetchers = [
-            { id = "git"; url = "*"; run = "git"; }
-            { id = "git"; url = "*/"; run = "git"; }
+            { id = "git"; url = "*"; run = "git"; group = "git"; }
+            { id = "git"; url = "*/"; run = "git"; group = "git"; }
           ];
           # Route only audio + subtitles to mediainfo's text metadata;
           # images/videos keep yazi's native visual thumbnails. Markdown

modules/nixos/default.nix

@@ -20,9 +20,9 @@ in
     # DEFAULT_HOSTNAME and upstream isNixos checks (see roadmap).
     system.nixos.distroName = lib.mkDefault "Nomarchy";
 
-    # Unfree allowed distro-wide: pragmatic-desktop territory (claude-code
-    # for the menu's ask-Claude module, vendor drivers, …). The custom
-    # nixpkgs-config type can't carry a nested mkDefault; disagree with
+    # Unfree allowed distro-wide: pragmatic-desktop territory (vendor
+    # GPU/wifi drivers, firmware, fonts, …). The custom nixpkgs-config
+    # type can't carry a nested mkDefault; disagree with
     # `nixpkgs.config = lib.mkForce { allowUnfree = false; }`.
     nixpkgs.config.allowUnfree = true;
 
@@ -85,6 +85,13 @@ in
     hardware.bluetooth.enable = lib.mkDefault cfg.bluetooth.enable;
     services.blueman.enable = lib.mkDefault cfg.bluetooth.enable;
 
+    # ── Foreign binaries: nix-ld ─────────────────────────────────────
+    # An ld.so shim so dynamically-linked binaries not built for NixOS
+    # (downloaded tools, language servers, pip/npm-installed ELFs, the
+    # npx-fetched claude-code) run without manual patchelf. On by default —
+    # a pragmatic-desktop expectation.
+    programs.nix-ld.enable = lib.mkDefault true;
+
     # ── Firmware ─────────────────────────────────────────────────────
     # Blobs for in-kernel drivers: wifi (iwlwifi/ath/rtw/brcm), SOF
     # audio, Bluetooth. Drivers ship with the kernel, but without these

modules/nixos/file-manager.nix

@@ -13,7 +13,7 @@ in
   config = lib.mkIf cfg.fileManager.enable {
     programs.thunar = {
       enable = lib.mkDefault true;
-      plugins = with pkgs.xfce; [
+      plugins = with pkgs; [
         thunar-archive-plugin    # create/extract archives from the context menu
         thunar-volman            # auto-manage removable drives/media
         thunar-media-tags-plugin # rename/inspect audio by tags
@@ -28,7 +28,7 @@ in
       ffmpegthumbnailer # video thumbnails (Thunar + yazi)
       libgsf            # ODF thumbnails
       poppler-utils     # PDF thumbnails / pdftoppm (yazi PDF preview too)
-      xfce.exo          # "Open Terminal Here" and default-app associations
+      xfce4-exo         # "Open Terminal Here" and default-app associations
       shared-mime-info  # MIME database
     ];
   };