Restructure nebula into dendritic (flake-parts + import-tree) layout

[kriswill]

What

Restructures the nebula NixOS flake to the dendritic pattern, mirroring the main/macOS branch. flake.nix's outputs is now just:

outputs = inputs: inputs.flake-parts.lib.mkFlake { inherit inputs; } (inputs.import-tree ./modules);

Every component lives as its own file under modules/ and is exposed through flake-parts outputs. snowglobe-lib's mkNixosHost is still the host builder — this is a reorganization of the local flake wiring, not a replacement of snowglobe.

Layout

File	Role
modules/flake-parts.nix	enables the flake.modules.nixos.* namespace + systems
modules/nixos.nix	host realizer — configurations.nixos registry → flake.nixosConfigurations + flake.checks via slib.mkNixosHost
modules/nixos/*.nix	the 8 shared modules, each wrapped { flake.modules.nixos.<name> = …; } (always-on, bodies unchanged)
modules/hosts/nebula.nix	registers the host; imports all features + _nebula/, applies overlays + sops
modules/hosts/_nebula/	host-specific plain modules — excluded from the import-tree scan (path contains /_), pulled in by explicit imports
modules/overlays.nix / modules/packages.nix	flake.overlays and per-system packages

Removes nixosConfigurations/, nixosModules/, overlays/default.nix (history preserved via git mv). Host secrets are now referenced via an explicit sops.defaultSopsFile (previously set by mkNixosHost's configDir, which is no longer passed).

Verification

• nixosConfigurations.nebula's system.build.toplevel is functionally identical to the pre-refactor baseline — closure 2866→2866, delta +0. The only diff is the sops secrets store path (the whole config dir → the secrets.yaml file); same encrypted content.
• nix flake check passes (one harmless unknown flake output 'modules' warning — the flake.modules.nixos.* namespace, same as on main).
• nix build .#packages.x86_64-linux.{helium,wowup,dots-adopt} all build through the overlays.
• CLAUDE.md and docs/ path references updated.

Notes

• Not yet activated (nixos-rebuild switch) — the new generation is functionally identical, so this can be switched at leisure.
• keyring.nix moved to modules/nixos/keyring.nix; harmless for the running system, noted in CLAUDE.md in case the snowglobe installer needs it on a fresh reinstall.

[kriswill]

Code review

Found 1 issue:

1. The secrets file was moved (nixosConfigurations/nebula/secrets.yaml → modules/hosts/_nebula/secrets.yaml), but .sops.yaml's creation_rules path_regex still points at the old path and wasn't updated in this PR. Editing secrets will fail with "no matching creation rules" — and the PR's own updated CLAUDE.md instructs sops modules/hosts/_nebula/secrets.yaml. (Build-time decryption is unaffected, since sops reads keys from the file's embedded metadata; only sops-editing/re-keying breaks.) Fix: update path_regex to modules/hosts/_nebula/secrets.yaml.

dotfiles/.sops.yaml

Lines 3 to 7 in 7b3e64d

	creation_rules:
	- path_regex: nixosConfigurations/nebula/secrets.yaml
	key_groups:
	- age:
	- *nebula

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}