Docker nix os

[asaxena76]

• Summary

Adds and hardens the Docker/NixOS workspace path for forever-claude-template.

This pairs with the mngr branch docker-nix-os, which adds the design doc and build gate documentation at:

specs/nixos-docker-workspace/design.md

Changes

• Add AGENTS.md shim pointing to CLAUDE.md.
• Add locked Nix flake support for the workspace system package set.
• Add Docker/NixOS image support under nix/Dockerfile.
• Pin the NixOS Docker base image by digest.
• Pin Nix packages through flake.lock on stable nixos-26.05.
• Add checked-in Nix closure manifest verification for aarch64-linux.
• Add manifest regeneration support via scripts/generate_nix_closure_manifest.sh.
• Add Docker image contract tests for the NixOS path.
• Fix Playwright/Chromium fontconfig compatibility in the NixOS image.
• Refactor NixOS setup into scripts/setup_system_nixos.sh so nix/Dockerfile stays parallel to the regular
  Dockerfile.

Paired mngr just command

The paired mngr PR adds:

just minds-build-fct-nixos

That command is the heavyweight, opt-in safe-build gate for this FCT Docker/NixOS path. It:

1. Uses .external_worktrees/forever-claude-template by default, or an explicit FCT path if provided.
2. Builds nix/Dockerfile to the fct-nix-profile target.
3. Verifies the realized Nix closure against nix/fct-workspace-closure..txt.
4. Fails early if the Nix closure changed unexpectedly.
5. Builds/runs the full Docker/NixOS image contract test with FCT_DOCKERFILE=nix/Dockerfile.

Example:

just minds-build-fct-nixos

or with an explicit FCT checkout and image tag:

just minds-build-fct-nixos .external_worktrees/forever-claude-template fct-nixos-contract:local

Validation

• uv run ruff check test_docker_image_contract.py test_mngr_template_stacking.py
• PYTEST_MAX_DURATION_SECONDS=120 uv run pytest test_mngr_template_stacking.py
• scripts/generate_nix_closure_manifest.sh
• just minds-build-fct-nixos from the paired mngr branch
• Heavy Docker/NixOS image contract passed via test_docker_image_contract.py::test_fct_dockerfile_image_contract

Notes

Only aarch64-linux has a checked-in closure manifest in this PR. x86_64-linux should remain unsupported by the safe
build gate until a manifest is generated from a suitable x86 builder.

[asaxena76]

Option to select docker/nixos

[asaxena76]

Tested claude in the nixos workspace. Tested playwright launch and screenshot