install-iwd: port to static-nix-shell

hosts/modules/roles/client/wifi-pairings.nix

@@ -1,12 +1,20 @@
 { config, lib, pkgs, ... }:
 
+let
+  install-iwd = pkgs.static-nix-shell.mkBash {
+    pname = "install-iwd";
+    src = ../../../../scripts;
+    pkgs = [ "gnused" ];
+  };
+in
 {
   config = lib.mkIf config.sane.roles.client {
     sane.fs."/var/lib/iwd/.secrets.psk.stamp" = {
       wantedBeforeBy = [ "iwd.service" ];
       generated.acl.mode = "0600";
       # XXX: install-iwd uses sed, but that's part of the default systemd unit path, it seems
-      generated.script.script = builtins.readFile ../../../../scripts/install-iwd + ''
+      generated.script.script = ''
+        ${install-iwd}/bin/install-iwd $@
         touch "/var/lib/iwd/.secrets.psk.stamp"
       '';
       generated.script.scriptArgs = [ "/run/secrets/net" "/var/lib/iwd" ];

scripts/install-iwd

@@ -1,4 +1,5 @@
-#!/bin/sh
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p gnused
 # usage: install-iwd <source_dir> <dest_dir>
 # source_dir contains plain-text .psk files of any filename.
 # for each file, this extracts the SSID and creates a symlink in dest_dir which