fix(nix): make extraPackages actually work via per-user profile

[alt-glitch]

Context

#17030 deprecated extraPackages because packages added to the systemd service PATH weren't visible to terminal commands, skills, or cron jobs — the terminal backend's login-shell snapshot rebuilds PATH from NixOS system profiles, discarding the service PATH.

The deprecation told users to switch to environment.systemPackages, which works but is a sledgehammer — it pollutes every user's shell on the system. If you only need pandoc for the hermes agent, you shouldn't have to put it in the global profile.

The fix

Instead of deprecating, make extraPackages actually work. One line of logic:

(lib.mkIf (cfg.extraPackages != []) {
  users.users.${cfg.user}.packages = cfg.extraPackages;
})

This tells NixOS "the hermes user has these packages," which creates a per-user profile at /etc/profiles/per-user/hermes/bin. That path is already in the PATH that /etc/set-environment constructs:

PATH="$HOME/.nix-profile/bin:…:/etc/profiles/per-user/$USER/bin:…:/run/current-system/sw/bin"

The login-shell snapshot (bash -l -c 'export -p') picks this up, so terminal commands, skills, and cron jobs all see the packages. The systemd path line still includes them too for direct process access.

Why this works for system users

NixOS creates per-user profiles for any user with packages != [] — there's no isNormalUser filter. From nixos/modules/config/users-groups.nix:

environment.etc = mapAttrs' (…)
  (filterAttrs (_: u: u.packages != [ ]) cfg.users);

Verification

Tested in a NixOS VM (nixos/lib runTest):

✔ /etc/profiles/per-user/hermes/bin exists
✔ hello and jq binaries present in per-user profile
✔ su - hermes -c 'which hello' → /etc/profiles/per-user/hermes/bin/hello
✔ su - hermes -c 'hello' → "Hello, world!"

Edge cases

• createUser = false: users.users.<name>.packages is additive — doesn't require the module to own the user definition. Works fine.
• Container mode: unaffected. extraPackages was always native-only (the systemd path line is inside !cfg.container.enable). The per-user profile lives on the host, not inside the container. No regression.

Changes

nix/nixosModules.nix

• Replace deprecation warning block with per-user profile wiring
• Update option description to reflect that it works everywhere now

website/docs/getting-started/nix-setup.md

• Revert quick-reference table to extraPackages (was changed to environment.systemPackages in fix(nix): deprecate extraPackages — does not reach terminal/skills #17030)
• Restore plugin example using extraPackages for system binaries
• Update options reference description

[qmx]

❤️ this looks good, my only concern is making sure we're augmenting, not replacing the existing package list