fix(nix): ship managed FAL backend in sealed package

[LeonSGP43]

Summary

• include the fal dependency group in the default Nix sealed runtime
• avoid first-use lazy install attempts for image generation inside the immutable store python
• keep the fix Nix-specific instead of widening [all] for every install path

Closes #30931

[DavSanchez]

Thanks for taking care of this!

I'm unfamiliar with the Hermes codebase. Do you think that this might be impacting other tools that require adding explicit dependencies to nixRuntimeDependencyGroups? Wondering about browser/computer use and so on. I still only use a fraction of what Hermes has to offer, but wondering if this issue might happen for some other feature when the time comes that I attempt to use it.

Perhaps a way to customize an existing setup via a home-manager module that works for macOS (or nix-darwin) could help. There's #9087 being worked on 🤔, would love to see it available!

[teknium1]

Thanks for the focused Nix fix. This is now covered on main through the package-variant implementation.

• Automated hermes-sweeper review verified nix/packages.nix:20-47: the full sealed runtime includes "fal" (:30), and packages.default = full (:47).
• The implementation merged in 976979489a682fecce6d6eb977f83e31254f3c18 (PR feat(nix): add #messaging and #full package variants #33108).
• The reporter of [Bug]: Image generation (and perhaps other Python-dependent tools) broken when Hermes Agent installed via Nix #30931 confirmed that the full package resolved the image-generation failure and closed that issue as solved.

Closing as implemented on main.