Always verify nix store on install

Just wasted a couple hours chasing shadows because the nix store got corrupted and there was no indication of that anywhere.

Since an install is one-time only, might as well verify and optimize.
The optimization also showed that the copied files aren't read-only; fixed that as well.

Err I don't know how that happened... hang on.