I hesitate to say it because it comes up in approximately every single conversation about package management, but... NixOS does all of those things. Whole list of packages in configuration.nix, whole of /etc encoded into configuration.nix, flakes let you pin everything, (therefore) it's trivial to check the whole OS config (packages, versions, configurations) into version control, home manager lets you do all this per-user (or you can do it in the system-wide configuration.nix if you really want), and you can drop a flake.nix+flake.lock in any project directory and scope things that way.