claim(M1-nixenv): single-source harness runtime env — ccciPyEnv+ccciRuntimeTools+cc-ci-run in packages.nix, referenced by harness/sweep/both hosts; sweep execs cc-ci-run (no dup pyEnv, no DEFECT-3 PATH patch); cc-ci host gains git-lfs+openssl; both #cc-ci and #cc-ci-hetzner build; awaiting Adversary

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

machine-docs/BACKLOG-nixenv.md

@@ -0,0 +1,19 @@
+# BACKLOG — phase `nixenv`
+
+## Build backlog
+
+- [x] M1: define shared harness/recipe-test runtime env once (overlay in `packages.nix`):
+      `ccciPyEnv` + `ccciRuntimeTools` (the union tool set) + `cc-ci-run`.
+- [x] M1: `harness.nix` references `pkgs.cc-ci-run` (no local pyEnv/runtimeInputs).
+- [x] M1: `nightly-sweep.nix` invokes `cc-ci-run` (no duplicate pyEnv, no own tool list, DEFECT-3 patch gone).
+- [x] M1: both host `configuration.nix` `systemPackages` reference `pkgs.ccciRuntimeTools` (+ openssh); end identical.
+- [x] M1: grep proof — exactly one `withPackages`/`pytest playwright` in nix/ (packages.nix); no module declares its own harness tool list.
+- [x] M1: `nixos-rebuild build` succeeds for both `#cc-ci` and `#cc-ci-hetzner`.
+- [x] M1: CLAIM, await Adversary PASS.
+- [ ] M2: deploy via `nixos-rebuild switch`; verify host health (systemctl --failed, oneshots, timer, endpoints).
+- [ ] M2: live parity — gitea `test_lfs_roundtrip` green under BOTH Drone path and a real timer fire from the unified env.
+- [ ] M2: canon-style sweep still promotes/SKIPs correctly (no regression).
+- [ ] M2: CLAIM, await Adversary PASS → `## DONE`.
+
+## Adversary findings
+<!-- Adversary-owned section. Builder does not edit. -->