refactor(youko): disable HDD spindown from a udev rule

Apply hdparm -B 255 -S 0 whenever a disk appears, which also covers the
re-add after a bridge reset, instead of a boot oneshot plus an hourly
timer. Drop -J 0: hdparm has always aborted it without
--please-destroy-my-drive, and wdidle3 already reads disabled on both
disks (it is persistent firmware state).

This was the last user of mylib.systemdHardening.privilegedOneshot, so
remove the preset and its test group.

Assisted-by: Claude Code (claude-opus-5-5)

outputs/x86_64-linux/tests/security-service-hardening/expected.nix

@@ -9,17 +9,6 @@ let
       "~@clock @cpu-emulation @debug @module @mount @obsolete @privileged @raw-io @reboot @swap"
     ];
   };
-
-  privilegedOneshot = {
-    CapabilityBoundingSet = "";
-    DeviceAllow = null;
-    NoNewPrivileges = true;
-    PrivateDevices = true;
-    PrivateNetwork = true;
-    ProtectKernelTunables = null;
-    ProtectSystem = "strict";
-    RestrictAddressFamilies = [ "AF_UNIX" ];
-  };
 in
 {
   # Only 80/443.
@@ -32,12 +21,4 @@ in
   whisper-asr = sandbox // {
     PrivateDevices = false;
   };
-
-  privilegedOneshot = {
-    hdd-no-spindown = privilegedOneshot // {
-      CapabilityBoundingSet = [ "CAP_SYS_RAWIO" ];
-      DeviceAllow = [ "block-sd rw" ];
-      PrivateDevices = false;
-    };
-  };
 }

outputs/x86_64-linux/tests/security-service-hardening/expr.nix

@@ -12,23 +12,6 @@ let
     lib.genAttrs names (
       n: lib.getAttrs keys outputs.nixosConfigurations.${host}.config.systemd.services.${n}.serviceConfig
     );
-
-  privilegedKeys = [
-    "CapabilityBoundingSet"
-    "DeviceAllow"
-    "NoNewPrivileges"
-    "PrivateDevices"
-    "PrivateNetwork"
-    "ProtectKernelTunables"
-    "ProtectSystem"
-    "RestrictAddressFamilies"
-  ];
-  privilegedUnit =
-    host: name:
-    let
-      cfg = outputs.nixosConfigurations.${host}.config.systemd.services.${name}.serviceConfig;
-    in
-    lib.genAttrs privilegedKeys (key: cfg.${key} or null);
 in
 units "youko" [
   "caddy"
@@ -36,8 +19,3 @@ units "youko" [
   "vmalert-homelab"
 ]
 // units "aquamarine" [ "whisper-asr" ]
-// {
-  privilegedOneshot = {
-    hdd-no-spindown = privilegedUnit "youko" "hdd-no-spindown";
-  };
-}