chore: rescue seven untracked scripts stranded in the main checkout

[ZacxDev]

Seven scripts had been sitting untracked in /home/zach/workspace/devrc while the repo moved 77+ commits ahead of that checkout. Untracked files are invisible to a flake build, so none of them were reaching a home-manager switch — and they were one routine checkout away from silent loss.

What's here

nix/system/ — three apply scripts, siblings of the five already tracked in that directory (apply-airvpn-host.sh, apply-travel-prep.sh, apply-dns-travel.sh, …), plus a paired backend module:

file
apply-mullvad-enable.sh	4.4K
apply-nebula-443.sh	732 B
apply-remove-gtk-portal.sh	1.8K
apply-file-manager-backend.sh + file-manager-backend.nix	2.3K + 928 B, paired

scripts/session-analysis/ — two extractors alongside the existing adoption-scan.py / initiative-scan.py / insights.py:

file
extract_genesis.py	3.3K
extract_user_msgs.py	5.2K

Checks run before committing

• gitleaks clean across all seven (18.75 KB) — with the scanner validated against a canary first. That mattered: gitleaks' default config allowlists the canonical AKIAIOSFODNN7EXAMPLE fixture, so my first negative control came back "no leaks found" on a file that was nothing but an AWS key pair. A realistic canary produced leaks found: 2, which is what makes the clean result on the real files meaningful. An unvalidated green here would have been worthless.
• The only secret-shaped match in the real files is a privateKeyFile path ("/etc/nixos/mullvad-wg.key"), not key material.
• bash -n on all four shell scripts, py_compile on both Python files, nix-instantiate --parse on the nix module — all pass.
• Modes match the directory's convention (apply-*.sh at 755; the Python files at 644, matching adoption-scan.py / insights.py).

Deliberately NOT included

• nix/pkgs/tools/screenarc.nix and its import in nix/pkgs/tools/default.nix — the import line is commented out (#++ (import ./screenarc.nix …)), i.e. parked on purpose. Left exactly as-is rather than guessing it was meant to ship.
• The uncommitted .npmrc deletion (dropping prefix = $HOME/.npm-packages) and the .serena/project.yml churn — operator decisions, not work at risk of loss.

Context

Found while triaging the main checkout's dirty tree ahead of a home-manager switch. Two other dirty files there turned out to be stale March orphans — scripts/tmux-task-hook.sh and scripts/tmux-task-resume.sh were byte-identical to their state at f69e583 (2026-03-24), so committing them would have reverted four months of work and reinstated a tmux rename-window call a later commit deliberately removed. Those were restored from HEAD, not carried here. Dirty ≠ WIP.