M0: flake + base NixOS config, rebuilt from repo on cc-ci

Pins nixpkgs to the rev cc-ci already ran (no-op-then-base); deploy via
switch --flake on-host. System healthy (gen 3) post-switch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

BACKLOG.md

@@ -6,10 +6,11 @@ Two single-writer sections (§6.1): Builder edits only `## Build backlog`; Adver
 ## Build backlog
 
 ### M0 — Foundations
-- [ ] Author flake.nix (NixOS host cc-ci) + hosts/cc-ci/{configuration,hardware}.nix from baseline
-- [ ] Deploy mechanism decision + first rebuild from repo (DECISIONS.md)
+- [x] Author flake.nix (NixOS host cc-ci) + hosts/cc-ci/{configuration,hardware}.nix from baseline
+- [x] Deploy mechanism decision + first rebuild from repo (DECISIONS.md) — switch --flake on host
 - [ ] sops-nix wiring: host age key, secrets/secrets.yaml, decrypt a test secret on host
-- [ ] Gate: M0 — `ssh cc-ci 'systemctl is-system-running'` healthy after rebuild from repo
+- [ ] Gate: M0 — `ssh cc-ci 'systemctl is-system-running'` healthy after rebuild from repo (base
+      rebuild verified healthy 2026-05-26; will CLAIM gate once sops test-secret also lands)
 
 ### M1 — Swarm + abra target
 - [ ] Docker + single-node swarm via Nix