[Staphylococcus]

Summary

Export public NixOS and Home Manager modules under services.lg-buddy, selecting matching user/config/runtime paths. Typed settings produce a Nix-attributed read-only overlay; ordinary preferences and native TV credentials remain writable user state outside the store.

NixOS owns machine discovery, boot/shutdown, logind lifecycle and NetworkManager pre-down integration. The lifecycle service waits through fresh pairing. Ordinary rebuilds preserve the active boot oneshot without TV actions; module removal also avoids TV actions and removes the shutdown hook. Both machine services preserve literal config paths, including systemd percent specifiers. Home Manager publishes before user-unit activation and conditionally refreshes only an active monitor; disabling it removes its declaration while retaining writable state.

Machine/user masks stop retained application update units without clearing preferences. Unmanaged collisions use normal Home Manager policy: preserve/move foreign symlinks explicitly, since backupFileExtension applies to regular files. Optional Plasma delivery builds the selected runtime's unchanged bridge with the host KWin/Qt; explicit user overrides win and a changed compositor/plugin needs a new session. Public docs cover install/update/activation/rollback/removal.

Scope

• This PR addresses one concern only.
• I split unrelated fixes, refactors, cleanup, or formatting into separate PRs.
• I read CONTRIBUTING.md and the relevant docs linked there.
• I discussed design-sensitive changes first, or this is a small obvious bug fix.

Relates to #253. The public modules are implemented; remaining physical lifecycle qualification keeps aggregate support acceptance open.

Validation

Head 20cd93956eca99e3b0e49da50515c531dd0ec5f7, base c102d93a97ab96a64be7d5a4b9738391d056f72e. All 24 checks in full CI passed on this head.

• Both architecture outputs/module options evaluate. Exact-head x86_64 package/installed-GUI, module-evaluation, public-module VM and matching KWin checks pass; package tests include 1,622 library cases (one existing physical smoke ignored). Outside-builder real-store ownership and declaration CLI probes pass.
• Behavioral regressions fail before their fixes and pass afterward: a literal %u config path reaches lifecycle/user command peers and installed root startup/shutdown unchanged; disabling both modules leaves the boot oneshot active without a TV action, and later stopping the removed unit causes no action. Tests use actual NixOS/Home Manager/systemd activation with recording TV/session command peers. Existing cases retain publication, update migration, active/inactive refresh, package/policy switches, rollback/removal and credential/preference preservation coverage.
• Both bootable GNOME and Plasma VMs pass at this head using an explicitly pinned Git flake. They run the actual CLI, wrapped GTK GUI, session/lifecycle daemons and compositors; only the TV is the central WebOS fixture. Fresh pairing/setup admission, managed versus editable controls, external updates, native idle/inhibition/activity restore, activation, actual boot into the changed generation, rollback and declaration removal preserve config/credentials. Versions: x86_64 NixOS 26.05test, kernel 6.18.57, GNOME 50.5 or Plasma/KWin 6.6.6 with Qt 6.11.2, GTK 4.22.5, libadwaita 1.9.4, systemd 260.5. Live Plasma bridge identity/getter checks pass. These full desktop runs are local qualification; CI runs the smaller recording-peer module VM.
• The original subagent reviewer checked the corrective three-file delta at this head, confirmed both findings resolved and reported no new actionable defects. They checked the diff and red/green VM evidence without duplicating the final broad runs.
• Earlier physical smoke at 8e0aec7 passed temporary Hearth activation, matching services/GUI/CLI and Complete setup, declared-edit refusal, updater masks, real brightness/volume reads and HDMI_3 blank/restore confirmed visually by the user. Hearth was restored with config/credential hashes and modes unchanged. That host run was not repeated for this corrective commit; no host activation, physical reboot/suspend or boot-generation change occurred in this follow-up.

Remaining #253 acceptance: fresh physical-TV pairing, physical suspend/resume and configured startup/shutdown, and physical idle/input restore. Native aarch64 remains unqualified. Merged into dev as 9b4a8369ea5862811ce3575ca15fbcc65dd96975; the remaining physical qualification stays tracked in #253.