[GDR]

Summary

Addresses the follow-up architectural review items on mkFeature:

1. Separate homeOptions and systemOptions (lib/features.nix):
   • Replaces extraOptions with homeOptions (exposed under hostUsers.<user>.modules.home.*) and systemOptions (exposed under options.modules.home.*).
   • Eliminates lib.recursiveUpdate between global and per-user featureCfg so per-user option defaults never overwrite global values.
   • Migrates steam to systemOptions and antigravity, zsh, git, and clavis to homeOptions.
2. Strict Per-User Option Typing (modules/_core/user.nix):
   • Removes freeformType = types.attrsOf types.anything; from hostUsers.<user>.modules.
3. Hard Dependency Validation (requires vs recommends):
   • Validates that all requires and recommends paths exist in moduleMap.
   • Throws an evaluation conflict error if an enabled feature transitively requires a module that the user explicitly disabled (enable = false), while still allowing enable = false to override category cascades and recommends.
4. Private Extension Host Wiring & justfile Override:
   • Updates mkDarwinConfiguration and mkNixosConfiguration to accept hostName and append privateExtension.hosts.${hostName}.modules or [ ].
   • Wires DOT_PRIVATE_EXTENSION into justfile rebuild/check recipes.
5. Opt-In User Privileges & Pure Evaluation:
   • Defaults hostUsers.<user>.extraGroups to [ ] and adds explicit trustedNixUser (default false).
   • Removes impure builtins.getEnv "CONTEXT7_API_KEY" from nix-goldstar.
6. Documentation & Regression Checks:
   • Updates README.md and .agents/ skills to remove stale mkModuleV2 and home.core references.
   • Expands checks.nix with scoped-options-and-requires and unprivileged user assertions.