setup-admin-sudo: add nix to NOPASSWD list

Single-user Nix on PVE nodes is owned by root. Add the fixed Nix binary
path (/nix/var/nix/profiles/default/bin/nix) to the NOPASSWD sudoers
rule so non-root SSH users can run nix build from create-proxmox-resource.sh.
Gracefully skips with a warning if Nix isn't installed yet (run after
codex-setup.sh bootstraps the node).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/setup-admin-sudo.sh

@@ -1,7 +1,11 @@
 #!/bin/bash
 # Grant a named admin user passwordless sudo for Proxmox management tools
-# (pvesh, qm, pct) so that scripts in the nixos flake repo can run these
-# over non-interactive SSH without a TTY for password entry.
+# (pvesh, qm, pct) and the Nix package manager so that scripts in the
+# nixos flake repo can run these over non-interactive SSH without a TTY.
+#
+# Nix is included because single-user Nix installations (common on PVE
+# hosts bootstrapped via codex-setup.sh) are owned by root; non-root
+# users can't touch the Nix store lock without sudo.
 #
 # Idempotent - safe to re-run (rewrites if paths have changed). Run as
 # root on the PVE host.
@@ -31,9 +35,17 @@ resolve_bin() {
 PVESH="$(resolve_bin pvesh)"
 QM="$(resolve_bin qm)"
 PCT="$(resolve_bin pct)"
+# Nix installs to a fixed path regardless of which user bootstrapped it.
+NIX_BIN="/nix/var/nix/profiles/default/bin/nix"
+if [ ! -x "$NIX_BIN" ]; then
+    echo "WARNING: $NIX_BIN not found -- Nix may not be installed yet." >&2
+    echo "         Re-run this script after running codex-setup.sh on the node." >&2
+    NIX_BIN=""
+fi
 
 SUDOERS_FILE="/etc/sudoers.d/${USERNAME}-proxmox"
-CONTENT="${USERNAME} ALL=(root) NOPASSWD: ${PVESH}, ${QM}, ${PCT}"
+NIX_ENTRY="${NIX_BIN:+, ${NIX_BIN}}"
+CONTENT="${USERNAME} ALL=(root) NOPASSWD: ${PVESH}, ${QM}, ${PCT}${NIX_ENTRY}"
 
 write_if_changed "$SUDOERS_FILE" "$CONTENT"