refactor: host profiles; give ruby, kana and aquamarine the TUI home (#512)

- Add the agent profile (modules/nixos/agent.nix: rootless Podman, linger,
  nix-ld) with home/linux/tui.nix as its home role; ruby, kana and
  aquamarine use it, so hosts no longer import from hosts/idols-ruby.
- Gate nushell's ~/.secrets source behind modules.shell.secrets.enable,
  off on agent hosts.
- Persist the TUI home state on aquamarine's tmpfs root.
- Document host profiles in hosts/README.md; add tests/agent-profile and
  drop the x86_64 colmena-parity test, which needs mysecrets.

Assisted-by: Claude Code (claude-opus-5-5)

hosts/idols-aquamarine/default.nix

@@ -67,14 +67,9 @@ in
   # VictoriaMetrics.
   services.smartd.enable = true;
 
-  # The inference engine ships as an OCI image and is meant to run rootless, so
-  # `podman` is what this host uses to build and start it from the `~/src` checkout
-  # that ./preservation.nix keeps.
-  virtualisation.podman.enable = true;
-
-  # Keep the user systemd manager running after logout and start it at boot,
-  # so enabled user services can run without an active login session.
-  users.users."${myvars.username}".linger = true;
+  # The inference engine ships as an OCI image and runs under the agent
+  # profile's rootless Podman (modules/nixos/agent.nix), built from the `~/src`
+  # checkout that ./preservation.nix keeps.
 
   # Speech recognition runs on the NPU, see ./asr.nix. The driver and the
   # compiler it loads come from NixOS/nixpkgs#570230, which is unmerged, so they

hosts/idols-aquamarine/preservation.nix

@@ -85,6 +85,84 @@ in
 
         ".config/systemd/user"
         ".config/containers/systemd"
+
+        # ======================================
+        # Home Manager TUI role (home/linux/tui.nix); the same paths `ai` keeps
+        # ======================================
+        ".local/state/home-manager"
+        ".local/state/nix/profiles"
+        ".local/share/nix"
+        ".config/nushell" # history
+
+        # ai agents
+        ".agents" # skills for all agents
+        ".config/agents"
+        ".codex"
+        ".dsh" # DeepSeek Harness
+        ".pi"
+        ".config/opencode"
+        ".local/share/opencode"
+        ".local/state/opencode"
+        # ctx7 docs lookup login
+        {
+          directory = ".config/context7";
+          mode = "0700";
+        }
+
+        # editors
+        ".local/share/nvim"
+        ".local/state/nvim"
+        ".local/share/jupyter"
+
+        # tuios session state, project-tape trust store and layout templates
+        {
+          directory = ".local/state/tuios";
+          mode = "0700";
+        }
+        {
+          directory = ".local/share/tuios";
+          mode = "0700";
+        }
+        ".config/tuios"
+
+        # cloud native
+        {
+          directory = ".aws";
+          mode = "0700";
+        }
+        {
+          directory = ".aliyun";
+          mode = "0700";
+        }
+        {
+          directory = ".config/gcloud";
+          mode = "0700";
+        }
+        {
+          directory = ".config/gh";
+          mode = "0700";
+        }
+        {
+          directory = ".kube";
+          mode = "0700";
+        }
+        ".terraform.d/plugin-cache"
+
+        # language package managers
+        ".npm"
+        "go"
+        ".cargo"
+        ".local/bin"
+        ".local/share/uv"
+
+        {
+          directory = ".gnupg";
+          mode = "0700";
+        }
+        {
+          directory = ".ssh";
+          mode = "0700";
+        }
       ];
     };
   };
@@ -123,6 +201,21 @@ in
       group = lib.mkForce username;
       mode = lib.mkForce "0750";
     };
+    "/home/${username}/.local/state".d = {
+      user = username;
+      group = lib.mkForce username;
+      mode = lib.mkForce "0750";
+    };
+    "/home/${username}/.local/state/nix".d = {
+      user = username;
+      group = lib.mkForce username;
+      mode = lib.mkForce "0750";
+    };
+    "/home/${username}/.terraform.d".d = {
+      user = username;
+      group = lib.mkForce username;
+      mode = lib.mkForce "0750";
+    };
   };
 
   systemd.tmpfiles.rules = [