feat: universal Nix setup with phase architecture, testing, and CI

[szymonos]

Summary

Introduces Nix as a cross-platform package manager for reproducible dev environment setup on Linux and macOS, with a phase library architecture, comprehensive testing framework, CI workflows, and repository restructuring.

Commits

1. refactor: reorganize provision scripts into check, fix, and setup dirs

Reorganizes .assets/provision/ into purpose-specific directories:

• check_*.sh → .assets/check/
• fix_*.sh → .assets/fix/
• setup_*.sh, set_*.sh → .assets/setup/

Removes deprecated scripts (install_brew.sh, install_pixi.sh, fix_certifi_certs.sh). Updates all path references in Vagrantfiles, Dockerfiles, linux_setup.sh, and source.sh.

2. feat: Nix-based cross-platform setup with declarative package management

Core infrastructure for managing dev tools via Nix:

• Phase library architecture (nix/lib/phases/) — setup.sh is a slim ~120-line orchestrator that sources 8 phase libraries (bootstrap, platform, scopes, nix_profile, configure, profiles, post_install, summary). Each phase uses _io_* wrappers (_io_nix, _io_run, _io_curl_probe) for testability.
• nix/setup.sh — main entry point for all platforms (macOS, Linux, WSL, containers). User-scope, rootless, idempotent.
• nix/flake.nix — declarative package set using buildEnv
• 19 scope files (nix/scopes/*.nix) — base, shell, python, k8s, az, docker, terraform, etc.
• Scope system — .assets/lib/scopes.json defines valid scopes, dependency rules, and install order; .assets/lib/scopes.sh provides resolution logic (bash 3.2 compatible)
• nx CLI — declarative package management commands: install, remove, list, scope add/remove, pin, rollback, overlay, doctor
• Configure scripts (nix/configure/) — per-scope setup for profiles, starship, omp, gh, git, conda, docker, az
• Certificate handling — fix_{azcli,gcloud,nodejs}_certs.sh for corporate proxy environments
• WSL integration — wsl_setup.ps1 extended with Nix path support
• Install records — .assets/lib/install_record.sh for provenance tracking

3. test: bats and Pester unit testing with pre-commit hooks

Bats tests (13 test files):

• test_nix_setup.bats — config generation, scope merging, arg parser, prompt exclusivity, nix profile operations
• test_scopes.bats — scope helpers, validation, dependency resolution
• test_nx_commands.bats, test_nx_scope.bats, test_nx_pkgs.bats — nx CLI operations
• test_nx_doctor.bats, test_overlay.bats — diagnostics and overlay system
• test_profile_block.bats, test_profile_migration.bats — profile injection
• test_source.bats, test_functions.bats, test_git_aliases.bats, test_fixcertpy_discovery.bats

Pester tests (9 test files):

• NxCommands.Tests.ps1, NxHelpers.Tests.ps1, Scopes.Tests.ps1 — PowerShell nx and scope logic
• ConvertCfg.Tests.ps1, ConvertPEM.Tests.ps1, GetLogLine.Tests.ps1, InvokeCommandRetry.Tests.ps1, JoinStr.Tests.ps1, WslSetup.Tests.ps1

Pre-commit hooks (via prek):

• check_bash32.py — enforces bash 3.2 compatibility on nix-path files
• validate_scopes.py — scope definition consistency between JSON and .nix files
• run_bats.py / run_pester.py — auto-detect and run affected tests
• align_tables.py — markdown table alignment
• gremlins.py — unwanted Unicode character detection

4. ci: Linux and macOS integration test workflows with Docker smoke tests

• test_linux.yml — runs nix/setup.sh in daemon and no-daemon (Coder) modes
• test_macos.yml — tests on macOS 14/15 with bash 3.2 and BSD sed
• repo_checks.yml — pre-commit hooks via prek
• Docker smoke test images (Dockerfile.test-nix, Dockerfile.test-legacy)
• Makefile targets: lint, test, test-unit, test-nix, test-legacy

5. docs: ARCHITECTURE.md, CONTRIBUTING.md, and project documentation

• ARCHITECTURE.md — file classification, call tree, runtime layout, bash 3.2/BSD sed constraints, phase library convention
• CONTRIBUTING.md — dev workflow, pre-commit hooks, testing patterns (_io_* stubs), style reference
• CLAUDE.md — updated project overview and coding guidelines
• AGENTS.md, SUPPORT.md, CHANGELOG.md
• docs/corporate_proxy.md, docs/customization.md — user-facing guides

6. chore: update configs, aliases, PS module fixes, and minor script tweaks

• Bash aliases: nix-aware paths, improved git/kubectl aliases
• OMP configs: updated prompt segments
• PowerShell fixes: IDictionary param types, LogContext variable rename, Join-Str default parameter set
• Provision scripts: minor fixes to install scripts

Test plan

• make lint passes (all pre-commit hooks clean)
• make test-unit passes (bats + Pester)
• make test-nix passes (Docker smoke test)
• CI workflows trigger via PR labels (test:linux, test:macos)
• Manual test: nix/setup.sh --shell --python on a clean environment

🤖 Generated with Claude Code