[smoldesu]

> some way to designate things like audio systems or your DE as “system” packages and as such be protected and very difficult to accidentally screw up with e.g. dependency resolution gone awry.

I do this on NixOS (and used Nix to do the same thing on MacOS). It's really great, but the up-front work of configuring everything can be a bit steep. The end result is pretty nice though - your environments are all sym-linked together from a common package store, and you can group together certain environments/package sets to update independently of one another. The icing on the cake is the rollback feature, where you can go back through the generations of your environment (until the packages get GCed).

It's not perfect (and it would test your patience), but Nix is an interesting commitment to the philosophy of using as much disk space as possible. I'm hopeful that someday it will be the de-facto package manager for Mac systems.