feat(remote-builders): build ai and shoukei on aquamarine (#467)

Aquamarine builds for ai and shoukei across the three platforms, with both
daemons logging in as root. They authenticate with their passphrase-free SSH
host keys, and ssh_known_hosts now carries each builder's address.

Assisted-by: DeepSeek Harness 0.2.0-rc.2 (deepseek-flash)

hosts/idols-aquamarine/README.md

@@ -221,6 +221,17 @@ reinstall or a key rotation:
 This config enables no `modules.secrets.*` group, so aquamarine decrypts nothing today; adding a
 group is what requires the recipient step above.
 
+## Remote builds
+
+Aquamarine is the fleet's remote Nix builder: 24C/96G, plus `boot.binfmt.emulatedSystems` for
+`aarch64-linux` and `riscv64-linux`, so one machine serves all three platforms. Clients opt in with
+`modules.remote-builders.enable`, defined in `modules/nixos/base/remote-builders.nix`.
+
+The builder's login user is `root`, which the daemon trusts by default, so this host needs no
+`nix.settings.trusted-users` entry of its own. Each client's daemon authenticates with its own SSH
+host key, which is passphrase-free and root-readable; `hosts/idols-aquamarine/default.nix`
+authorizes those keys for root.
+
 ## Deploy
 
 ```bash

hosts/idols-aquamarine/default.nix

@@ -68,6 +68,9 @@ in
   # so enabled user services can run without an active login session.
   users.users."${myvars.username}".linger = true;
 
+  # The daemons of the hosts that build here (modules/nixos/base/remote-builders.nix).
+  users.users.root.openssh.authorizedKeys.keys = myvars.remoteBuilderClientKeys;
+
   # systemd-journal - cap disk usage
   # https://www.freedesktop.org/software/systemd/man/latest/journald.conf.html
   services.journald.settings.Journal = {