homebrew.onActivation.cleanup: option to fail activation as part of checks

[ian-h-chamberlain]

With Homebrew/homebrew-bundle#1418 there is now an easy command available to check if any brews, casks, vscodes would be removed by --cleanup. I was thinking about adding another option for homebrew.onActivation.cleanup (perhaps "check"?), which simply fails the pre-activation checks if the system is not in sync with the generated Brewfile (could also be used with darwin-rebuild check without actually performing uninstalls). For now I have something like this in my own config, but thought it seemed like it might be useful enough to upstream; it also relies on some internal options to work:

{ pkgs, config, ... }:
let
  brewfileFile = pkgs.writeText "Brewfile" config.homebrew.brewfile;
in
{
  system.checks.text = ''
    PATH="${config.homebrew.brewPrefix}":$PATH brew bundle cleanup --file='${brewfileFile}' --no-lock
  '';
}

Would a PR adding this as a first-class option be accepted? If so, I wasn't sure whether it should be another choice for onActivation.cleanup, or a separate option like homebrew.onActivation.checkCleanup. I could see wanting something like this, but I'm not sure if there's any precedent for options like this that have different outcomes during check vs switch:

{
	homebrew.onActivation = {
		checkCleanup = true; # only fails `darwin-rebuild check`
		cleanup = "zap"; # invokes --zap on `darwin-rebuild switch`
	};
}