gate: add kunchenguid/no-mistakes for all Nix harnesses

- home.nix: add home.activation.noMistakes (declarative install to
  ~/.no-mistakes/bin + daemon via launchd, global config fallback
  agent: [pi, opencode, grok, claude, codex] covering every harness
  declared in Nix; fix shadowing of jonathanong npm no-mistakes)
- ~/.no-mistakes/config.yaml: switched from auto to ordered fallback,
  pi first (firstmate crewmates), then opencode/grok
- home/.pi/agent/*, home/.grok/config.toml, home/.config/opencode2:
  align to oMLX/qwen3.6-35b local model (was mixed Talos/genesis)
- rebuild.sh: ensure grok-build upgrade and OpenCode 1.x install on
  rebuild (stable CLI for free-tier, opencode2 beta is 426 there)
- dotfiles repo: no-mistakes init (gate at
  ~/.no-mistakes/repos/916cb6ded81b.git, remote no-mistakes)

home.nix

@@ -227,5 +227,42 @@ in
     fi
     "$npm" install -g --allow-scripts=@opencode-ai/cli @opencode-ai/cli@beta
   '';
+
+  # kunchenguid/no-mistakes gate (git push no-mistakes) - declarative install + daemon + global config
+  # Covers every harness declared in Nix: pi (pi-coding-agent), opencode (oc2/fm), grok (grok-build),
+  # plus claude/codex aspirational (aliases cc/co). Binary lives in ~/.no-mistakes/bin
+  # with symlink ~/.local/bin/no-mistakes (installer default). Do NOT npm install -g no-mistakes
+  # - that npm name is jonathanong's static-analysis tool (shadowing bug fixed 2026-09-21).
+  home.activation.noMistakes = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+    set -euo pipefail
+    bin="$HOME/.no-mistakes/bin/no-mistakes"
+    link="$HOME/.local/bin/no-mistakes"
+    # Install/refresh via upstream installer if missing or not kunchenguid build
+    if [ ! -x "$bin" ] || ! "$bin" --version 2>/dev/null | grep -q "kunchenguid\|v1\."; then
+      if [ -x "$bin" ]; then
+        echo "no-mistakes: replacing unexpected binary at $bin" >&2
+      fi
+      curl -fsSL https://raw.githubusercontent.com/kunchenguid/no-mistakes/main/docs/install.sh | sh
+    fi
+    # Ensure global config covers all Nix harnesses (idempotent - only writes if missing or still `agent: auto`)
+    cfg="$HOME/.no-mistakes/config.yaml"
+    if [ -f "$cfg" ] && grep -qE '^\s*agent:\s*auto\s*$' "$cfg"; then
+      tmp="$(mktemp)"
+      awk '
+        /^\s*agent:\s*auto\s*$/ {
+          print "# Managed by dotfiles/home.nix home.activation.noMistakes";
+          print "agent: [pi, opencode, grok, claude, codex]";
+          next
+        }
+        { print }
+      ' "$cfg" > "$tmp" && mv "$tmp" "$cfg"
+    fi
+    if [ ! -f "$cfg" ]; then
+      mkdir -p "$(dirname "$cfg")"
+      printf 'agent: [pi, opencode, grok, claude, codex]\n' > "$cfg"
+    fi
+    # Ensure daemon running (launchd on macOS)
+    "$bin" daemon restart >/dev/null 2>&1 || "$bin" daemon start >/dev/null 2>&1 || true
+  '';
 }