Add live RadiantWave updater (dev variants)

Add a radiantwave-updater NixOS module that polls a manifest on the
fileserver and swaps the app pointer /var/lib/radiantwave/current to new
closures fetched from the dev Attic cache. Closures are fetched with
'nix copy --from', never built from source; the swap is atomic via
mv -T.

Enable it on the -dev variants only for now: the login shell launches
from /var/lib/radiantwave/current/bin/radiantwave when enabled, and from
the immutable system path otherwise, so prod behavior is unchanged. The
pointer is seeded on first boot to the baseline copy already baked into
the closure (no duplication).

configuration.nix

@@ -1,7 +1,15 @@
-{ pkgs, radiantwave, upgradeFlakeRef, radiantwavePlymouth, ... }:
+{ config, pkgs, radiantwave, upgradeFlakeRef, radiantwavePlymouth, ... }:
 
 let
   radiantApp = radiantwave.packages.${pkgs.system}.default;
+  # When the live-updater module is enabled (currently dev variants only),
+  # RadiantWave launches through the mutable /var/lib/radiantwave/current
+  # pointer so it can be swapped without a full nixos-rebuild. Otherwise it
+  # launches straight from the immutable system closure as before.
+  launchBin =
+    if config.services.radiantwaveUpdater.enable or false
+    then "/var/lib/radiantwave/current/bin/radiantwave"
+    else "/run/current-system/sw/bin/radiantwave";
   myKey = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4qWNZnYU5JaqR9c2qh6oFZktzVNBOx42PfDaGofCL6 cnclack@pm.me macbook" ];
 in
 {
@@ -159,7 +167,7 @@ in
       # Release the splash screen right before the compositor takes over the display
       sudo -n plymouth quit --wait || true
 
-      exec dbus-run-session cage -- /run/current-system/sw/bin/radiantwave -d -s > /tmp/kiosk.log 2>&1
+      exec dbus-run-session cage -- ${launchBin} -d -s > /tmp/kiosk.log 2>&1
     fi
   '';