vm: add aarch64 UTM test target + cleanup pi/qmd placement

- nixosConfigurations.vm: minimal NixOS for aarch64 UTM testing
  - modules/vm.nix: network, SSH, user, no display manager
  - imports shared + wgu home configs, no desktop/Hyprland
- Moved pi/qmd from sscoble.nix → desktop.nix (clean separation)

flake.nix

@@ -82,6 +82,27 @@
       ];
     };
 
+    # === VM: minimal NixOS for testing (aarch64, UTM) ===
+    nixosConfigurations.vm = nixpkgs.lib.nixosSystem {
+      system = "aarch64-linux";
+      modules = [
+        home-manager.nixosModules.home-manager
+        ./modules/vm.nix
+        {
+          home-manager = {
+            useGlobalPkgs = true;
+            useUserPackages = true;
+            users.sscoble = {
+              imports = [
+                ./home/sscoble.nix
+                ./home/wgu.nix
+              ];
+            };
+          };
+        }
+      ];
+    };
+
     # === macOS: home-manager standalone (no desktop, no Hyprland) ===
     homeConfigurations.sscoble = home-manager.lib.homeManagerConfiguration {
       pkgs = nixpkgs.legacyPackages.${darwinSystem};

home/desktop.nix

@@ -3,6 +3,9 @@
 {
   # === Linux desktop packages ===
   home.packages = with pkgs; [
+    # pi + qmd (from overlay)
+    pi-coding-agent
+    qmd
     # Terminal
     ghostty
     zellij

home/sscoble.nix

@@ -32,15 +32,10 @@
     curl
     wget
   ] ++ (if pkgs.stdenv.isLinux then (with pkgs; [
-    # Linux-specific packages
-    pi-coding-agent
-    qmd
     nodejs
     bun
     git
-  ]) else [
-    # macOS: pi, qmd, node, bun, git come from homebrew
-  ]);
+  ]) else []);
 
   # === Home directory (conditional) ===
   home.homeDirectory = if pkgs.stdenv.isDarwin

modules/vm.nix

@@ -0,0 +1,52 @@
+{ config, lib, pkgs, ... }:
+
+{
+  # === Minimal NixOS VM for flake testing (aarch64, UTM) ===
+
+  # Boot
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  # Networking
+  networking.hostName = "scobleclaw-vm";
+  networking.networkmanager.enable = true;
+  networking.useDHCP = false;
+  networking.interfaces.eth0.useDHCP = true;
+
+  # Time zone / locale
+  time.timeZone = "America/Los_Angeles";
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  # User
+  users.users.sscoble = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" "networkmanager" ];
+    initialPassword = "changeme";  # Change on first login
+  };
+
+  # Security: allow passwordless sudo for wheel
+  security.sudo.wheelNeedsPassword = false;
+
+  # SSH for remote access
+  services.openssh = {
+    enable = true;
+    settings.PasswordAuthentication = true;
+  };
+
+  # Standard packages (keep it minimal)
+  environment.systemPackages = with pkgs; [
+    git
+    curl
+    wget
+    vim
+    htop
+    tmux
+    tree
+  ];
+
+  # Enable flakes
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+
+  # State version
+  system.stateVersion = "25.11";
+}