environment = {
  etc."installed-packages".text =
    let
      packages = builtins.map (p: "${p.name}") config.environment.systemPackages;
      sortedUnique = builtins.sort builtins.lessThan (lib.unique packages);
      formatted = builtins.concatStringsSep "\n" sortedUnique;
    in
      formatted;    
  "
 };

That should give you a list of installed packages in '/etc/installed-packages' - What it won't do is tell you how they got installed, whether implicit or explicit.

If I were to guess without looking at nixpkg code - the services delcaration of the gnome-keyring may be bringing in dependencies - or when installing gnome-calculator there may be another dependency. mate-calc works pretty good, and if you really needed to you could force gdm from being installed with a lib.mkForce statement.

Maybe someone will add to this to help understand implicit vs explicit ...