Over 400 comments and it’s all flamewars and almost zero discussion of NixOS.
I think NixOS would be a great solution for this sort of environment. With something like impermanence enabled to make the systems immutable, you could push all configuration from a central server and ensure that there is no drift. You could even use read-only nix stores served over nfs. This would all be easier if your hardware is limited to a few select configurations, of course.
I am curious about your confidence for NFS for the nix store.
My thoughts, ignoring my technical disagreements, would be that you'd want to setup clients to have a specific set of software per their government role. A nix store could expose more software than you planned on supporting (e.g. forgotten software or licensed software).