Gnome browser, I’d use ladybird but it’s not ready yet
You can install imperatively using nice profiles. So you the OP can set up the base distro in a way their SO can’t break. Then any extra software can be installed imperatively using nix profiles. Any installed software will work as normals. Checking the normal places for configurations if their SO even needs to go that far
Nixos with whatever defaults you don’t want her touching, then she can use nix profiles to install extra software if she wants
Xournal++ works pretty good in my experience
Why not make them executable and stick them in bin