Add central Nix builder and binary cache

[moons-14]

Summary

• add deploy-rs configuration for SSH deployment of nix-builder with automatic and magic rollback
• add the central build-server policy, bounded build concurrency, emergency store GC thresholds, and persistent fleet GC roots
• add fleet-build and fleet-deploy commands for rooted builds and deployments
• add a socket-activated Harmonia binary cache exposed only on Tailscale TCP 5000
• add a reusable homelab binary-cache client profile and bootstrap documentation
• move the common user password secret declaration into the selected security.secrets profile so the builder can use SOPS without requiring that secret

Storage policy

The documented Proxmox layout is:

• 48 GiB for /
• 192 GiB for /var/lib/nix-build
• 1 TiB for /nix/store

The builder starts emergency GC below 64 GiB free and targets 128 GiB free. Latest fleet closures remain protected by indirect GC roots under /var/lib/nix-fleet/roots.

Bootstrap required after merge

Harmonia remains stopped until the host-specific SOPS signing key exists. After the VM has a stable SSH host key:

1. add the builder Age recipient and creation rule to .sops.yaml
2. generate and encrypt secrets/hosts/nix-builder/system.yaml
3. add modules/systems/nix/homelab-cache/public-key
4. select networking.homelab-cache-client on client hosts

Exact commands are documented in hosts/nix-builder/README.md.

Validation

• evaluated nixosConfigurations.nix-builder.config.system.build.toplevel.drvPath
• evaluated deploy-rs schema and activation checks
• built the Registry evaluation test
• passed nixfmt, deadnix, statix, ShellCheck, Prettier, gitleaks, and git diff --check
• confirmed the evaluated Harmonia socket, signing-key path, Tailscale firewall port, build directory, GC thresholds, fleet tools, and persistent root directories

A full closure build could not finish in the temporary validation container because its filesystem rejected a dependency unpack step that attempted chown to uid 1000/gid 100. The targeted NixOS and deploy-rs evaluations passed. No nh os switch was run.