feat(darwin): declare brew/nixpkgs packages for macOS continuity

Migrate the prior Homebrew package set onto the nix-darwin host. Leaf CLI formulae move to nixpkgs (environment.systemPackages); pure library deps are dropped since nix resolves them transitively. firefoxpwa and version-pinned llvm@21/lld@21/python@3.14 stay on brew. All GUI apps remain brew casks, since nixpkgs darwin GUI support is unreliable.

system/machine/Darwin/configuration.nix

@@ -5,7 +5,60 @@
 { pkgs, username, ... }:
 {
   programs.zsh.enable = true;
-  environment.systemPackages = [ pkgs.git ];
+
+  # CLI tooling sourced from nixpkgs instead of Homebrew formulae. Pure library
+  # dependencies are omitted; nix pulls them into closures automatically.
+  environment.systemPackages = with pkgs; [
+    # Build & toolchain
+    autoconf
+    automake
+    cmake
+    coreutils
+    gcc
+    gettext
+    gnumake
+    pkgconf
+    ruby
+    zig
+    # Version control & dev workflow
+    pre-commit
+    deno
+    opentofu
+    # Compression
+    lz4
+    p7zip
+    xz
+    zstd
+    # Crypto & networking
+    gnupg
+    gnutls
+    openssl
+    pinentry_mac
+    unbound
+    wget
+    # Media
+    ffmpeg
+    svt-av1
+    yt-dlp
+    # Graphics / Vulkan / SDL
+    glslang
+    moltenvk
+    spirv-tools
+    vulkan-loader
+    vulkan-tools
+    SDL2
+    sdl3
+    # Embedded
+    esptool
+    picotool
+    # Misc utilities
+    f3
+    gnused
+    lua5_4
+    magic-wormhole
+    ncurses
+    sqlite
+  ];
 
   # Account that runs user-level activation and Homebrew.
   system.primaryUser = username;
@@ -30,8 +83,52 @@
       cleanup = "zap";
     };
     taps = [ ];
-    brews = [ ];
+    # Formulae kept on brew: vendor PWA host and version-pinned toolchains that
-    casks = [ ];
+    # are simpler to track via brew than to match exactly in nixpkgs.
+    brews = [
+      "firefoxpwa"
+      "llvm@21"
+      "lld@21"
+      "python@3.14"
+    ];
+    # GUI applications. macOS app bundles are managed as casks; nixpkgs darwin
+    # GUI support is unreliable, so these stay on brew for continuity.
+    casks = [
+      "alfred"
+      "android-platform-tools"
+      "angry-ip-scanner"
+      "arduino-ide"
+      "autodesk-fusion"
+      "bambu-studio"
+      "bitwarden"
+      "citrix-workspace"
+      "curseforge"
+      "discord"
+      "firefox"
+      "freecad"
+      "gcc-arm-embedded"
+      "google-chrome"
+      "istat-menus"
+      "iterm2"
+      "macfuse"
+      "microsoft-teams"
+      "nextcloud"
+      "obs"
+      "omnidisksweeper"
+      "openscad@snapshot"
+      "orcaslicer"
+      "plex"
+      "plexamp"
+      "postman"
+      "signal"
+      "steam"
+      "thunderbird"
+      "virtualbox"
+      "visual-studio-code"
+      "vnc-viewer"
+      "vscodium"
+      "winbox"
+    ];
     masApps = { };
   };