fix(nix): install writable home-manager config instead of store symlink

The Home Manager module symlinked ~/.omp/agent/config.yml to a read-only
/nix/store path. OMP acquires an advisory lock on and atomically rewrites
its config when persisting runtime changes; on macOS the lock backend
creates an flock sidecar next to the target, so the first startup save
failed with "Failed to acquire native file lock ... Permission denied
(os error 13)", breaking every launch once programs.omp.settings was set.

Copy the generated config into place as a writable regular file via
home.activation instead. OMP can now lock and rewrite it, and the next
home-manager switch reapplies the declared settings. The DAG entry is
written literally so the home-manager-free module evaluation in flake.nix
keeps working; that check now asserts the activation entry.

Fixes #8775

nix/home-manager.nix

@@ -8,6 +8,7 @@
 let
   cfg = config.programs.omp;
   yaml = pkgs.formats.yaml { };
+  configFile = yaml.generate "omp-config.yml" cfg.settings;
 in
 {
   options.programs.omp = {
@@ -25,8 +26,11 @@ in
       default = null;
       description = ''
         Settings written declaratively to {file}`~/.omp/agent/config.yml`.
-        The file is a read-only store symlink: changes made from inside OMP
-        (`/settings`, onboarding) replace it but revert on the next
+        On each `home-manager switch` the declared settings are copied into
+        place as a writable regular file (not a read-only store symlink), so
+        OMP can acquire its config lock and rewrite the file when persisting
+        runtime changes (`/settings`, onboarding). Those runtime changes are
+        overwritten by the declared values again on the next
         `home-manager switch`.
       '';
       example = {
@@ -38,8 +42,21 @@ in
 
   config = lib.mkIf cfg.enable {
     home.packages = [ cfg.package ];
-    home.file.".omp/agent/config.yml" = lib.mkIf (cfg.settings != null) {
-      source = yaml.generate "omp-config.yml" cfg.settings;
+
+    # OMP rewrites its config at runtime and acquires an advisory lock on it
+    # first; on macOS the lock backend creates an flock sidecar next to the
+    # target file. A `home.file` store symlink is read-only and lives under
+    # /nix/store, so both the lock and the atomic rewrite fail with EACCES and
+    # break every launch. Copy a writable regular file instead. The DAG entry
+    # is written literally (rather than via `lib.hm.dag.entryAfter`) so the
+    # home-manager-free module evaluation in `flake.nix` keeps working.
+    home.activation.ompConfig = lib.mkIf (cfg.settings != null) {
+      before = [ ];
+      after = [ "writeBoundary" ];
+      data = ''
+        run mkdir -p "$HOME/.omp/agent"
+        run install -m 600 ${configFile} "$HOME/.omp/agent/config.yml"
+      '';
     };
   };
 }