refactor: host profiles; give ruby, kana and aquamarine the TUI home (#512)

- Add the agent profile (modules/nixos/agent.nix: rootless Podman, linger,
  nix-ld) with home/linux/tui.nix as its home role; ruby, kana and
  aquamarine use it, so hosts no longer import from hosts/idols-ruby.
- Gate nushell's ~/.secrets source behind modules.shell.secrets.enable,
  off on agent hosts.
- Persist the TUI home state on aquamarine's tmpfs root.
- Document host profiles in hosts/README.md; add tests/agent-profile and
  drop the x86_64 colmena-parity test, which needs mysecrets.

Assisted-by: Claude Code (claude-opus-5-5)

home/README.md

@@ -15,7 +15,7 @@ home/
 │   │   └── ...
 │   └── ...
 ├── hosts/             # Host-specific home manager entry modules
-│   ├── linux/         # Linux host home modules (idols-ai, 12kingdoms-shoukei, idols-kana, idols-ruby)
+│   ├── linux/         # Linux host home modules (idols-ai, 12kingdoms-shoukei, idols-aquamarine, idols-kana, idols-ruby)
 │   └── darwin/        # macOS host home modules (fern, frieren)
 └── darwin/            # macOS-specific home manager configurations
     ├── proxy/         # Proxy configurations

home/base/tui/shell/default.nix

@@ -1,17 +1,26 @@
 {
   config,
+  lib,
   nu_scripts,
   ...
 }:
 {
-  programs.nushell = {
+  options.modules.shell.secrets.enable = lib.mkOption {
+    type = lib.types.bool;
+    default = true;
+    description = "Source ~/.secrets/nushell-secrets.nu, which only the desktops sync.";
+  };
+
+  config.programs.nushell = {
     # the file must exist, otherwise nushell will complain about it!
     #
     # currently, nushell does not support conditional sourcing of files
     # https://github.com/nushell/nushell/issues/8214
     extraConfig = ''
-      # decrypted secret: AI agents must not read it
-      source ${config.home.homeDirectory}/.secrets/nushell-secrets.nu
+      ${lib.optionalString config.modules.shell.secrets.enable ''
+        # decrypted secret: AI agents must not read it
+        source ${config.home.homeDirectory}/.secrets/nushell-secrets.nu
+      ''}
 
       # Directories in this constant are searched by the
       # `use` and `source` commands.

home/hosts/README.md

@@ -10,8 +10,9 @@ This directory contains host-specific Home Manager entry modules.
 ## Conventions
 
 1. Each host output should reference only one file under `home/hosts/...`.
-2. Shared home module imports should be handled in the host file itself.
-   - Linux hosts usually import `../../linux/core.nix` or `../../linux/gui.nix`.
+2. The host file imports its profile's home role, see
+   [Host Profiles](../../hosts/README.md#host-profiles).
+   - `desktop` hosts import `../../linux/gui.nix`; `agent` hosts import `../../linux/tui.nix`.
    - Darwin hosts import `../../darwin`.
 3. Host-specific overrides (SSH keys, desktop toggles, host-local config links) live in the same
    host file.

home/hosts/linux/idols-aquamarine.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ../../linux/tui.nix
+  ];
+}

home/hosts/linux/idols-kana.nix

@@ -1,7 +1,6 @@
 {
   imports = [
-    ../../linux/core.nix
-    ../../linux/gui/i3
+    ../../linux/tui.nix
   ];
 
   # Headless X11/i3 session for computer use.

home/hosts/linux/idols-ruby.nix

@@ -1,7 +1,6 @@
 {
   imports = [
-    ../../linux/core.nix
-    ../../linux/gui/i3
+    ../../linux/tui.nix
   ];
 
   # Headless X11/i3 session for computer use.

home/linux/gui/i3/README.md

@@ -46,8 +46,9 @@ tree the agent reads, so it stays.
   the systemd user manager, clears any stale `WAYLAND_DISPLAY`, and enables the AT-SPI bridge via a
   gsettings key.
 - Drivers come from the nur-ryan4yin overlay (`overlays/nur-ryan4yin.nix`).
-- Host wiring: `home/hosts/linux/idols-ruby.nix`, `home/hosts/linux/idols-kana.nix`,
-  `hosts/idols-ruby/computer-use.nix`.
+- Wiring: the `agent` profile imports both sides, off by default
+  ([Host Profiles](../../../../hosts/README.md#host-profiles));
+  `hosts/idols-{ruby,kana}/default.nix` and `home/hosts/linux/idols-{ruby,kana}.nix` turn them on.
 
 ## The i3 config
 

home/linux/tui.nix

@@ -1,3 +1,5 @@
+# Home role of the `agent` profile (hosts/README.md#host-profiles): the full
+# TUI stack for a headless host.
 {
   imports = [
     ../base/core
@@ -5,5 +7,10 @@
     ../base/home.nix
 
     ./base
+    # off by default; a host turns it on with modules.desktop.computerUse.enable
+    ./gui/i3
   ];
+
+  # ~/.secrets is synced to the desktops only.
+  modules.shell.secrets.enable = false;
 }