fix(power): pin the tuned profile per host, cap the VM hosts (#458)

Assisted-by: DeepSeek Harness (deepseek-flash)

hosts/12kingdoms-shoukei/default.nix

@@ -21,8 +21,11 @@ in
 
   # disable sunshine for security
   services.sunshine.enable = lib.mkForce false;
-  # battery-first: override the profile default
-  services.tuned.ppdSettings.main.default = lib.mkForce "power-saver";
+  # battery-first: pin the low-power profile. apple-cpufreq exposes no EPP or
+  # platform_profile, so the only thing this changes is cpufreq boost.
+  services.tuned.recommend = {
+    powersave = { };
+  };
 
   # Laptop joins untrusted networks and is never scraped (see youko's
   # `offlineHosts`); don't expose :9100, and don't keep the smartctl exporter