refactor: host profiles; give ruby, kana and aquamarine the TUI home (#512)

- Add the agent profile (modules/nixos/agent.nix: rootless Podman, linger,
  nix-ld) with home/linux/tui.nix as its home role; ruby, kana and
  aquamarine use it, so hosts no longer import from hosts/idols-ruby.
- Gate nushell's ~/.secrets source behind modules.shell.secrets.enable,
  off on agent hosts.
- Persist the TUI home state on aquamarine's tmpfs root.
- Document host profiles in hosts/README.md; add tests/agent-profile and
  drop the x86_64 colmena-parity test, which needs mysecrets.

Assisted-by: Claude Code (claude-opus-5-5)

hosts/idols-akane/default.nix

@@ -15,9 +15,6 @@ in
 {
   imports = (mylib.scanPaths ./.) ++ [
     disko.nixosModules.default
-
-    ../idols-ruby/packages.nix
-    ../idols-ruby/oci-containers
   ];
 
   # supported file systems, so we can mount any removable disks with these filesystems