nixos: run non-FHS claude-desktop so the integrated terminal can sudo

The FHS variant (claudeDesktopFhs) wraps the app in buildFHSEnv -> bubblewrap,
which runs in an unprivileged user namespace. That makes host root impossible
for the integrated Claude Code terminal (setuid sudo resolves to an unmapped
uid). Switch to the non-FHS claude-desktop package, which runs in the host
namespace, so sudo / nixos-rebuild work from inside the app. MCP/Cowork
features that assume an FHS layout may need nix-ld/envfs as a follow-up.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nixos/code.nix

@@ -184,7 +184,12 @@ in
         alejandra
       ]
       ++ lib.optionals (config.networking.hostName != "jay-lenovo") [
-        claudeDesktopFhs
+        # Non-FHS variant: runs in the host namespace (no bwrap userns), so the
+        # integrated Claude Code terminal can use sudo / nixos-rebuild. The FHS
+        # variant (claudeDesktopFhs) sandboxes everything in an unprivileged user
+        # namespace, which makes host root impossible. Trade-off: MCP/Cowork
+        # features that assume an FHS layout may need nix-ld/envfs instead.
+        claudeDesktop
         cabal2nix
       ]
       ++ (