nixos: container profile, update /init symlink on rebuild