feat(darwin): wire nix-homebrew and make Homebrew authoritative

Add the nix-homebrew input and darwin module so the Homebrew prefix is installed and owned declaratively (no manual bootstrap), with enableRosetta for x86_64 formulae on Apple Silicon and user = host username.

Set homebrew.onActivation.cleanup = zap so the taps/brews/casks/masApps lists are authoritative: anything not declared is removed on activation.

flake.lock

@@ -1,5 +1,22 @@
 {
   "nodes": {
+    "brew-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1778427648,
+        "narHash": "sha256-pt9KaDGsMyYWB9JeHs4XGHs870f1lOZe3vx9LpVIhUE=",
+        "owner": "Homebrew",
+        "repo": "brew",
+        "rev": "6f293daa9f9f5832e13b497976335e90509886d7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Homebrew",
+        "ref": "5.1.11",
+        "repo": "brew",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "locked": {
         "lastModified": 1761640442,
@@ -93,6 +110,24 @@
         "type": "github"
       }
     },
+    "nix-homebrew": {
+      "inputs": {
+        "brew-src": "brew-src"
+      },
+      "locked": {
+        "lastModified": 1778851564,
+        "narHash": "sha256-p8wzcnpB2Iys+QzAKM9/Eyw/pUyqCO3sw/NCnDH4dTE=",
+        "owner": "zhaofengli",
+        "repo": "nix-homebrew",
+        "rev": "b3a87b4793205cc111f3c61e25e018ffac3b8039",
+        "type": "github"
+      },
+      "original": {
+        "owner": "zhaofengli",
+        "repo": "nix-homebrew",
+        "type": "github"
+      }
+    },
     "nixos-apple-silicon": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -171,6 +206,7 @@
         "flake-parts": "flake-parts",
         "home-manager": "home-manager",
         "nix-darwin": "nix-darwin",
+        "nix-homebrew": "nix-homebrew",
         "nixos-apple-silicon": "nixos-apple-silicon",
         "nixos-wsl": "nixos-wsl",
         "nixpkgs": "nixpkgs",

flake.nix

@@ -18,6 +18,8 @@
     # nix-darwin: manage macOS hosts from this same flake.
     nix-darwin.url = "github:nix-darwin/nix-darwin/nix-darwin-26.05";
     nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
+    # nix-homebrew: declaratively own and install the Homebrew prefix on macOS.
+    nix-homebrew.url = "github:zhaofengli/nix-homebrew";
     # Provides mkFlake: the systems/perSystem scaffolding used below.
     flake-parts.url = "github:hercules-ci/flake-parts";
     flake-parts.inputs.nixpkgs-lib.follows = "nixpkgs";
@@ -32,6 +34,7 @@
       nixos-wsl,
       nixos-apple-silicon,
       nix-darwin,
+      nix-homebrew,
       ...
     }:
     flake-parts.lib.mkFlake { inherit inputs; } (
@@ -109,6 +112,7 @@
         # Shared scaffolding for every Darwin (macOS) host.
         darwinBaseModules = [
           commonModule
+          nix-homebrew.darwinModules.nix-homebrew
           home-manager.darwinModules.home-manager
           {
             home-manager.useGlobalPkgs = true;

system/machine/Darwin/configuration.nix

@@ -10,18 +10,24 @@
   # Account that runs user-level activation and Homebrew.
   system.primaryUser = username;
 
+  # nix-homebrew owns and installs the Homebrew prefix declaratively, so brew
+  # itself no longer needs a manual bootstrap. enableRosetta permits x86_64
+  # formulae via Rosetta 2 on Apple Silicon.
+  nix-homebrew = {
+    enable = true;
+    enableRosetta = true;
+    user = username;
+  };
+
   # Declarative Homebrew for packages with no nixpkgs equivalent or that must be
-  # the vendor build (GUI casks, Mac App Store apps). Homebrew itself must already
-  # be installed:
-  #   /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+  # the vendor build (GUI casks, Mac App Store apps).
   homebrew = {
     enable = true;
     onActivation = {
       autoUpdate = true;
       upgrade = true;
-      # "none" leaves manually-installed formulae alone. Switch to "zap" to make
-      # the lists below fully authoritative (uninstalls anything not declared).
-      cleanup = "none";
+      # Lists below are authoritative: anything not declared is uninstalled.
+      cleanup = "zap";
     };
     taps = [ ];
     brews = [ ];