mercurial: enable MQ extension

hosts/common/programs/assorted.nix

@@ -849,9 +849,6 @@ in
 
     marksman.sandbox.whitelistPwd = true;
 
-    mercurial.sandbox.net = "clearnet";
-    mercurial.sandbox.whitelistPwd = true;
-
     mesa-demos.sandbox.whitelistDri = true;
     mesa-demos.sandbox.whitelistWayland = true;
     mesa-demos.sandbox.whitelistX = true;

hosts/common/programs/default.nix

@@ -123,6 +123,7 @@
     ./megapixels.nix
     ./megapixels-next.nix
     ./mepo.nix
+    ./mercurial.nix
     ./mimeo
     ./mimetype.nix
     ./mmcli.nix

hosts/common/programs/mercurial.nix

@@ -0,0 +1,19 @@
+{ ... }:
+{
+  sane.programs.mercurial = {
+    sandbox.net = "clearnet";
+    sandbox.whitelistPwd = true;
+    sandbox.extraHomePaths = [
+      # even with `whitelistPwd`, hg has to crawl *up* the path -- which isn't necessarily in the sandbox -- to locate the repo root.
+      "dev"
+      "ref"
+    ];
+    fs.".config/hg/hgrc".symlink.text = ''
+      [extensions]
+      # Mercurial Queues (MQ) extension adds patch-stack support to mercurial.
+      # MQ is shipped in mercurial, but not enabled by default.
+      # it's a port of some git extension, idk which.
+      mq =
+    '';
+  };
+}