Move insecure-pnpm/broadcom-sta allowance to common.nix (vesktop on all hosts)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

common.nix

@@ -91,6 +91,12 @@
   # Allow unfree packages
   nixpkgs.config.allowUnfree = true;
 
+  # vesktop (multiple hosts) builds with pnpm via fetchPnpmDeps, which nixpkgs
+  # marks insecure (build-time only, hash-pinned FOD — not in PATH). broadcom-sta
+  # is Macbook-only Wi-Fi but allowing it everywhere is harmless (absent on others).
+  nixpkgs.config.allowInsecurePredicate = pkg:
+    lib.any (p: lib.hasPrefix p (lib.getName pkg)) [ "broadcom-sta" "pnpm" ];
+
   # Flakes — nixos-rebuild self-enables these, but plain `nix eval` /
   # `nix flake check` on the hosts need them too.
   nix.settings.experimental-features = [ "nix-command" "flakes" ];

hosts/hardware/FredOS-Macbook.nix

@@ -55,8 +55,7 @@
     })
   ];
 
-  nixpkgs.config.allowInsecurePredicate = pkg:
-    lib.any (p: lib.hasPrefix p (lib.getName pkg)) [ "broadcom-sta" "pnpm" ];
+  # allowInsecurePredicate (broadcom-sta + pnpm) lives in common.nix now.
 
   services.xserver.deviceSection = lib.mkDefault ''
       Option "TearFree" "true"