fix(aquamarine): persist the user's unit directories (#464)

Assisted-by: DeepSeek Harness (deepseek-flash)

hosts/idols-aquamarine/preservation.nix

@@ -72,19 +72,33 @@ in
         # not listed is gone on the next boot; weights are re-downloadable, but
         # re-downloading tens of GB is not a boot step.
         "models"
+
+        ".config/systemd/user"
+        ".config/containers/systemd"
       ];
     };
   };
 
   # `.config`/`.local` are not immediate parents of any persisted path here, so
   # tmpfiles would create them root:root 0755 and the user could not write
-  # under them. Same fix as hosts/idols-ai/preservation.nix.
+  # under them. Same fix as hosts/idols-ai/preservation.nix, plus the `.config`
+  # subdirectories that hold a mount point.
   systemd.tmpfiles.settings.preservation = {
     "/home/${username}/.config".d = {
       user = username;
       group = lib.mkForce username;
       mode = lib.mkForce "0750";
     };
+    "/home/${username}/.config/systemd".d = {
+      user = username;
+      group = lib.mkForce username;
+      mode = lib.mkForce "0750";
+    };
+    "/home/${username}/.config/containers".d = {
+      user = username;
+      group = lib.mkForce username;
+      mode = lib.mkForce "0750";
+    };
     "/home/${username}/.local".d = {
       user = username;
       group = lib.mkForce username;

outputs/x86_64-linux/tests/idols-aquamarine/expected.nix

@@ -8,6 +8,7 @@
   cStatesCapped = true;
   nativeIpv6Preference = true;
   sourceCheckoutsPersistent = true;
+  userUnitDirsPersistent = true;
   rootlessPodmanEnabled = true;
   stableKernel = true;
   btopShowsRadeon = true;

outputs/x86_64-linux/tests/idols-aquamarine/expr.nix

@@ -36,6 +36,16 @@ in
   sourceCheckoutsPersistent = builtins.any (
     d: d.directory == "/home/${myvars.username}/src"
   ) cfg.preservation.preserveAt."/persistent".users.${myvars.username}.directories;
+
+  # Directories the tmpfs root would otherwise drop.
+  userUnitDirsPersistent =
+    let
+      dirs = cfg.preservation.preserveAt."/persistent".users.${myvars.username}.directories;
+    in
+    builtins.all (path: builtins.any (d: d.directory == "/home/${myvars.username}/${path}") dirs) [
+      ".config/systemd/user"
+      ".config/containers/systemd"
+    ];
   rootlessPodmanEnabled = cfg.virtualisation.podman.enable;
 
   # A server tracks the nixpkgs default (stable/LTS) kernel, not `-latest`.