nixos/etc-overlay: fix machine-id-commit on first-boot when /etc is RO

The upstream unit has ConditionPathIsReadWrite=/etc, which is always
false on the read-only overlay, so the previous commit alone requires
users that want persistence to override the conditions themselves before
the generated ID can be written back.

Use ConditionFirstBoot instead, with the empty placeholder
first-boot is "no" and commit stays skipped, but when a writable
file containing "uninitialized" is bind-mounted over /etc/machine-id,
first-boot is "yes" once and commit writes the ID through the bind.

nixos/modules/system/etc/etc-activation.nix

@@ -194,6 +194,25 @@
         text = "";
         mode = "0444";
       };
+
+      # The upstream unit has ConditionPathIsReadWrite=/etc, which is always
+      # false here. Replace it with ConditionFirstBoot: with the empty
+      # placeholder above first-boot is "no" and commit stays skipped, but
+      # when a persistence module bind-mounts a writable file containing
+      # "uninitialized" over /etc/machine-id, first-boot is "yes" once and
+      # commit writes the generated ID through the bind mount.
+      #
+      # An empty Condition*= assignment resets *all* condition types, and
+      # this attrset is serialised in key order, so the reset goes through
+      # ConditionFirstBoot (sorts first) and we re-add the upstream
+      # ConditionPathIsMountPoint afterwards.
+      systemd.services.systemd-machine-id-commit.unitConfig = {
+        ConditionFirstBoot = lib.mkDefault [
+          ""
+          "true"
+        ];
+        ConditionPathIsMountPoint = lib.mkDefault "/etc/machine-id";
+      };
     })
 
   ];