The listener service had ProtectHome=read-only which prevented Nix from writing to /root/.cache when fetching git flakes. This adds a CacheDirectory managed by systemd and sets XDG_CACHE_HOME to use it. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>