[motrm]

Mildly pedantic, and of course ignores how wild this whole thing is, but I don't think this bit is correct:

  After waiting for a little while, the program terminated with the following output:
  
  astrid@chungus infra  gzip -vc result/nixos.img | ssh [e-mail] -- bash -c 'gunzip -vc > /dev/sda'
  [e-mail]'s password:
   77.8% -- replaced with stdout
  
  What happened here?

The 77.8% bit is gunzip -v reporting that it finished decompressing the data to stdout and that the compression ratio was 77.8%... so this invocation may well have succeeded. Assuming, as rwmj points out, nothing else stomped on any of the written blocks.

I do like this idea - with sufficient prep of the system before writing the image, namely stopping as many processes as possible especially those that might do some writing, it's a quick and dirty way to replace a stock OS with a ready-made image. Could perhaps be safer doing it twice, once into a minimal image that does very little beyond network bringup & runs ssh, followed by final OS replacement in a (more) controlled manner.