feat(shoukei): run x86/x86_64 apps and games via muvm+FEX

Apple Silicon's 16K pages mean FEX cannot run natively and qemu-user cannot
run complex x86_64 binaries. Wire the maintained rowanG077/nix-x86-on-aarch64
runtime (FEX inside a 4K muvm microVM) into shoukei so games, Steam, Wine and
other x86/x86_64 programs work, and let the module own the x86 ELF handlers
instead of qemu-user.

The input is pinned to our fork (ryan4yin/nix-x86-on-aarch64) at the reviewed
commit. Dropping boot.binfmt.emulatedSystems also removes x86_64 from
nix.settings.extra-platforms, so the qemu-user/uncached-x86-build gap is
recorded as WA-022.

- flake.nix: add nix-x86-on-aarch64 input (WA-021)
- hosts/12kingdoms-shoukei/game/: programs.x86-on-arm + steam/wine, 6 GiB VM
- hardware-configuration.nix: drop emulatedSystems/preferStaticEmulators
- apple-silicon.nix: drop the now-redundant box64
- docs: WA-012 resolved; WA-021 and WA-022 added; host README updated

hosts/12kingdoms-shoukei/README.md

@@ -5,6 +5,25 @@ This is NixOS's configuration for my Macbook Pro 2022 M2, 16G RAM.
 This laptop joins untrusted networks and uses DHCP instead of a static IP, so it has no entry in
 `vars/networking.nix`.
 
+## x86/x86_64 applications
+
+The M2 uses 16 KiB pages, and FEX does not emulate 4 KiB guest pages, so x86/x86_64 binaries cannot
+run directly on this kernel. [`game/`](./game/default.nix) enables `programs.x86-on-arm` from
+[our fork](https://github.com/ryan4yin/nix-x86-on-aarch64) of
+[rowanG077/nix-x86-on-aarch64](https://github.com/rowanG077/nix-x86-on-aarch64), which runs FEX
+inside a 4 KiB `muvm` microVM and registers both ELF handlers:
+
+- run an x86/x86_64 ELF directly, or use `x86-arm run <program>`;
+- `nix-shell -p x86pkgs.hello --run hello` for the x86 package set;
+- `steam` and `x86-arm-wine` for games and Windows programs.
+
+The microVM is capped at 6 GiB (`memoryMiB`) on this 16 GiB machine, and needs `/dev/kvm` plus a
+running systemd user session. See [WORKAROUNDS.md](../../WORKAROUNDS.md) WA-021.
+
+Because the host no longer registers qemu-user binfmt, `podman run --platform=linux/amd64`, x86
+chroots, and local builds of uncached x86 derivations need a remote x86_64 builder (see
+[WORKAROUNDS.md](../../WORKAROUNDS.md) WA-022).
+
 Related:
 
 - [M2 Series Feature Support - Asahi Linux](https://asahilinux.org/docs/platform/feature-support/m2/)

hosts/12kingdoms-shoukei/apple-silicon.nix

@@ -26,10 +26,6 @@
     ];
   };
 
-  environment.systemPackages = with pkgs; [
-    box64 # Linux Userspace x86 and x86_64 Emulator, run x86_64 apps(such as games, gui apps) on aarch64.
-  ];
-
   # configures the network interface(include wireless) via `nmcli` & `nmtui`
   networking.networkmanager.enable = true;
 

hosts/12kingdoms-shoukei/default.nix

@@ -14,6 +14,7 @@ in
 {
   imports = [
     ./hardware-configuration.nix
+    ./game
     # shoukei reuses ai's preservation layout; no host-specific overrides yet
     ../idols-ai/preservation.nix
   ];

hosts/12kingdoms-shoukei/game/default.nix

@@ -0,0 +1,17 @@
+# x86/x86_64 applications and games on this Apple Silicon host.
+#
+# FEX cannot run on the 16K pages this machine boots with, so
+# nix-x86-on-aarch64 runs FEX inside a 4K-page muvm microVM and owns the
+# x86_64/i686 ELF handlers. Pinned to our fork; see WORKAROUNDS.md WA-021.
+{ nix-x86-on-aarch64, ... }:
+{
+  imports = [ nix-x86-on-aarch64.nixosModules.default ];
+
+  programs.x86-on-arm = {
+    enable = true;
+    steam.enable = true;
+    wine.enable = true;
+    # 16 GiB machine: cap what the guest may demand instead of muvm's 80% default.
+    memoryMiB = 6144;
+  };
+}

hosts/12kingdoms-shoukei/hardware-configuration.nix

@@ -23,14 +23,9 @@ in
   # depending on how you configured your disk mounts, change this to /boot or /boot/efi.
   boot.loader.efi.efiSysMountPoint = "/boot";
 
-  # Enable binfmt emulation of aarch64-linux, this is required for cross compilation.
-  boot.binfmt.emulatedSystems = [
-    "x86_64-linux"
-    "riscv64-linux"
-  ];
-  # This enables the kernel to preload the emulator binaries when the binfmt registrations are added,
-  # obviating the need to make the emulator binaries available inside chroots and chroot-like sandboxes.
-  boot.binfmt.preferStaticEmulators = true; # required to work with podman
+  # Foreign-architecture emulation is not used on this host: x86/x86_64 programs
+  # run through `./game` (FEX inside a muvm microVM), which owns the x86_64/i686
+  # ELF handlers, and qemu-user cannot run them on 16K pages anyway.
   nixpkgs.overlays = [
     (final: previous: {
       # https://github.com/NixOS/nixpkgs/issues/392673