feat: Add nix-darwin (macOS) deployment support

[angerman]

Add support for deploying to macOS machines using nix-darwin, alongside the
existing NixOS support.

Capabilities

• SystemType (NixOS vs Darwin), threaded through evaluation, build, copy, and
  activation.
• evalDarwinNode in eval.nix evaluates darwin nodes via nix-darwin's
  darwinSystem; meta.nix-darwin supplies the input.
• Node system type is resolved from an explicit deployment.systemType, or
  auto-detected from a flake's darwinConfigurations.
• Darwin-specific profile activation (sw/bin/darwin-rebuild activate), with the
  boot goal correctly reported as unsupported on darwin.
• darwinDefaults for darwin-only defaults.
• colmena apply-local and buildOnTarget work on macOS, including when
  connecting as root.
• Handles macOS specifics where root's PATH (and sudo's secure_path) lack the
  nix binaries: absolute nix paths for local/remote commands, remote-program
  on the ssh-ng store, and nix copy (rather than legacy nix-copy-closure)
  for darwin targets.

Credits

The apply-local/root buildOnTarget enablement and the initial darwin test
coverage are by @sini, preserved as their own commits. Thanks!

Usage (flake)

{
  inputs.nix-darwin.url = "github:LnL7/nix-darwin";

  outputs = { nixpkgs, nix-darwin, ... }: {
    colmena = {
      meta = {
        nixpkgs = import nixpkgs { system = "aarch64-darwin"; };
        nix-darwin = nix-darwin;          # required for darwin nodes
      };

      my-mac = {
        deployment.systemType = "darwin"; # or auto-detected via darwinConfigurations
        deployment.targetHost = "my-mac.local";
        # ... darwin configuration ...
      };
    };
  };
}

Notes

• Darwin nodes require meta.nix-darwin to be set.
• Non-flake darwin deployments use nix copy for closure transfer (the legacy
  nix-copy-closure path cannot target nix on a macOS host without a PATH on the
  remote); flake deployments already used this path.

[angerman]

@zhaofengli let me know if this is the right direction of travel or not.

[angerman]

@zhaofengli ping :-)

[sini]

I was able to test your branch and verified that that build and apply work.

There doesn't appear to be support for allowLocalDeployment as colmena apply-local doesn't seem to work.

buildOnTarget doesn't seem to work when connecting as root.

Otherwise it seems functional, sudo as a user works for buildOnTarget

[stepbrobd]

sorry for getting back so late!

a little heads up here, i plan to review this after #340 so you might need to rebase a few times

[sini]

I had added some enhancements on top of this / finished out some of the incomplete features and opened a PR here against the upstream of this PR: zw3rk#1 but with no response

I personally would really like to see this PR move forward so if nobody takes up the mantle I'd be happy to continue working on it / stop maintaining my fork. :)

[stepbrobd]

if you want you can cherry pick the commits you needed and open a new PR and take over if @angerman doesn't reply soon, though remember to give proper credit in the commit msg!

[sini]

if you want you can cherry pick the commits you needed and open a new PR and take over if @angerman doesn't reply soon, though remember to give proper credit in the commit msg!

If that happens, then yes, of course. I'll preserve the original author commit details during rebase. Hopefully though @angerman just missed the PR and this activity will motivate them. :)

[angerman]

🙌