Copy applications instead of linking them to make macOS happy

All existing attempts fell short.
So we fall back to plain old copying applications over.

Problems with alternatives:

- Symlinking: Spotlight doesn't index symlinks. Therefore one cannot use
Spotlight to find or open the apps. Also they don't show up in
LaunchPad.

- Trampolines: Apples Security & Privacy doesn't get the concept and
shows them with the wrong name. Having an app open during an update will
also make it show up twice in the Dock.

- Aliasses: Require either AppleScript (a permission we don't want to
have, as it easily bypasses Apples TCC) or extra tools (that would be
ok), but also Aliasses are not categorized as 'Application' by
SpotLight.

- Directory Hardlinks are not supported by APFS - but also wouldn't work
cross volume.

- clonefile also doesn't work cross-volume.

Which all leads us back to Don Copine and Pastone. *sigh*

modules/system/applications.nix

@@ -38,12 +38,33 @@ in
         rm ~/Applications/'Nix Apps'
       fi
 
-      if [ ! -e '/Applications/Nix Apps' ] \
-         || ourLink '/Applications/Nix Apps'; then
-        ln -sfn ${cfg.build.applications}/Applications '/Applications/Nix Apps'
-      else
-        echo "warning: /Applications/Nix Apps is not owned by nix-darwin, skipping App linking..." >&2
+      targetFolder='/Applications/Nix Apps'
+
+      # Clean up old style symlink to nix store
+      if [ -e "$targetFolder" ] && ourLink "$targetFolder"; then
+        rm "$targetFolder"
       fi
+
+      mkdir -p "$targetFolder"
+
+      rsyncFlags=(
+        # mtime is standardized in the nix store, which would leave only file size to distinguish files.
+        # Thus we need checksums, despite the speed penalty.
+        --checksum
+        # Converts all symlinks pointing outside of the copied tree (thus unsafe) into real files and directories.
+        # This neatly converts all the symlinks pointing to application bundles in the nix store into
+        # real directories, without breaking any relative symlinks inside of application bundles.
+        # This is good enough, because the make-symlinks-relative.sh setup hook converts all $out internal
+        # symlinks to relative ones.
+        --copy-unsafe-links
+        --archive
+        --delete
+        --chmod=-w
+        --no-group
+        --no-owner
+      )
+
+      ${lib.getExe pkgs.rsync} "''${rsyncFlags[@]}" ${cfg.build.applications}/Applications/ "$targetFolder"
     '';
 
   };