From how you’ve described modifying your distro, that’s literally NixOS. Your entire config is declared in a git repo, when you update the system it rebuilds it from that repo. But you’ll have to learn the nix language, and it’s not a easy-to-use, beginner-friendly distro.
Wow, that’s terrible for security.