How do you configure things without something basically equivalent to writing to /etc?

And whatever you do use to configure things, what if photoshop accessed it directly? I'm sure you'd be upset with that even if it didn't touch /etc.

If something is system wide i want a commit based workflow (with minor exceptions like dhcp / ip)

Everything else should be in its own folder without the ability to change anything outside of that folder.

Well my point is that switching to a commit-based workflow with no runtime changes doesn't solve the problem of adobe setup including a malicious commit.

Isolating things to a specific folder is what actually gives any security here, and you can do that on a writable /etc too.

yes and you need shared read-only global state. like resolv.conf

We get it, you like Nix

NixOS is not a read only OS. There is an impermanence addon that can do this, though, for many partitions.

Nix has some good ideas but it is not exactly what I would love to have.