fix(systemd): sandbox privileged hardware oneshots

Assisted-by: DeepSeek Harness (deepseek-flash)

hosts/idols-aquamarine/hardware-amd-gpu.nix

@@ -1,5 +1,6 @@
 {
   pkgs,
+  mylib,
   myvars,
   ...
 }:
@@ -83,7 +84,7 @@
     wantedBy = [ "multi-user.target" ];
     after = [ "systemd-modules-load.service" ];
     path = [ pkgs.coreutils ];
-    serviceConfig = {
+    serviceConfig = mylib.systemdHardening.privilegedOneshot // {
       Type = "oneshot";
       RemainAfterExit = true;
       ExecStart = pkgs.writeShellScript "amdgpu-power-cap" ''