Add uv and a rootless Docker runtime on NixOS hosts

uv joins the CLI package list. Docker's daemon is now actually managed
on NixOS hosts too, in rootless mode (per-user systemd service, no
docker-group root-equivalent access), rather than leaving the runtime
entirely externally-managed as before -- the already-installed docker
CLI picks it up automatically via DOCKER_HOST. This is a documented,
narrow exception to developer-environment's client-only tools policy;
kubectl and awscli2 remain unaffected.

Archives add-uv-and-docker-runtime and syncs the new container-runtime
capability plus the narrowed developer-environment requirement into
the main specs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HngxrvqEzq8oBEBDtrYJyB

1 files changed, 6 insertions, 0 deletions

diff --git a/modules/nixos/common.nix b/modules/nixos/common.nix
index a219850..10f48c6 100644
--- a/modules/nixos/common.nix
+++ b/modules/nixos/common.nix
@@ -68,4 +68,10 @@
     nssmdns4 = true;
     openFirewall = true;
   };
+
+  # Rootless: runs as the user's own systemd user service, not as root, and
+  # has no docker-group privilege-escalation path. setSocketVariable exports
+  # DOCKER_HOST automatically so the docker CLI (dev-tools.nix) just works.
+  virtualisation.docker.rootless.enable = true;
+  virtualisation.docker.rootless.setSocketVariable = true;
 }