The fix is clean and working. Here's a summary of what was done:

**Root cause**: GDM 50 relies on `DCONF_PROFILE=gdm` being set in the greeter's environment so that `gnome-session` reads `session-name='gnome-login'` from dconf and launches the login screen. GDM sets this variable via `environment.d/gdm.conf` in the greeter's home directory. On NixOS, this file was never being created because:

1. The `/run/gdm/.config` directory was owned by `gdm:gdm` (from the old tmpfiles rule)
2. Subdirectories were owned by `gdm-greeter:gdm` 
3. systemd-tmpfiles refused to write across the ownership boundary ("unsafe path transition")
4. GDM's own `gdm.conf` writing also failed silently for the same reason

**Fix**:

1. **Fixed tmpfiles ownership** — Changed `/run/gdm/.config` and all subdirectories to be consistently owned by `gdm-greeter:gdm` instead of `gdm:gdm`. This eliminates the "unsafe path transition" errors.

2. **Added `environment.d/10-dconf.conf`** — Writes `DCONF_PROFILE=gdm` so the systemd user manager picks it up for all greeter processes.

Result: `gnome-session-manager@gnome-login.service` starts instead of `@gnome.service`, and `org.gnome.Shell@gdm.service` (the login greeter) runs instead of `@user.service` (full desktop).