Add most-used dev tools, sshd/firewall, bash+liquidprompt shell

modules/home/dev-tools.nix provisions the developer's evidenced most-
used CLI/client tooling (gh, tmux, htop, yq-go, tree-sitter, docker,
docker-compose, kubectl, awscli2). modules/home/shell.nix drops zsh/
starship/direnv in favor of bash + liquidprompt, both left entirely to
the user's own dotfiles for config since home-manager can't own
~/.bashrc without conflicting with it. modules/nixos/common.nix adds
sshd (key-only auth) and a firewall baseline for future NixOS hosts.

1 files changed, 33 insertions, 0 deletions

diff --git a/openspec/changes/add-developer-environment/specs/developer-environment/spec.md b/openspec/changes/add-developer-environment/specs/developer-environment/spec.md
new file mode 100644
index 0000000..aff76b5
--- /dev/null
+++ b/openspec/changes/add-developer-environment/specs/developer-environment/spec.md
@@ -0,0 +1,33 @@
+## Purpose
+
+Provisions the developer's most-used CLI/client tooling through the shared home-manager profile and enables common baseline system services, such as SSH access, on every NixOS host built from this flake.
+
+## ADDED Requirements
+
+### Requirement: Developer CLI tools are provisioned via the shared home profile
+The shared home-manager profile SHALL include the user's evidenced most-used CLI and client tools, available identically wherever that profile is activated (standalone or via a NixOS host).
+
+#### Scenario: Tooling available after activation
+- **WHEN** the shared home profile is activated on any supported platform
+- **THEN** the provisioned developer CLI tools are available on `PATH` without any additional manual installation step
+
+### Requirement: Container and cloud tools are client-only
+Container and cloud-related packages provisioned by this capability SHALL provide client/CLI functionality only; they SHALL NOT attempt to provide or manage the underlying runtime or service (e.g. a container engine or cloud account).
+
+#### Scenario: No runtime is installed or managed
+- **WHEN** a container or cloud CLI tool is provisioned by the shared home profile
+- **THEN** no corresponding daemon, virtual machine, or account configuration is installed or managed by this capability — the tool simply connects to whatever runtime or account is already configured on the system
+
+### Requirement: Shell and prompt configuration defers to the user's personal dotfiles
+Where the user's personal dotfiles repository already owns a piece of shell or prompt configuration, the shared home profile SHALL provide only the underlying package, not a competing managed configuration for that same file.
+
+#### Scenario: Prompt tool provisioned without managed config
+- **WHEN** the shared home profile provisions a prompt tool whose configuration is already owned by the user's dotfiles repository
+- **THEN** the profile installs the tool's package but does not generate or manage a competing configuration file for it
+
+### Requirement: SSH access is enabled by default on NixOS hosts
+Every NixOS host built from this flake's shared system module SHALL have an SSH server enabled, with password authentication and root login disabled, and SHALL permit inbound SSH traffic through its firewall.
+
+#### Scenario: SSH reachable with key-based auth only
+- **WHEN** a NixOS host is built from the shared system module
+- **THEN** the SSH service is enabled, password authentication and root login are disabled, and the firewall permits inbound connections on the SSH port