docs(agents): correct rule boundaries and eval scenarios

Assisted-by: DeepSeek Harness (claude-opus-5-5, deepseek-flash, qwen3.8-flash-next iq3)

.agents/skills/nix-config-desktop/SKILL.md

@@ -31,8 +31,7 @@ back with git, and needs no rebuild. Only the store layer needs one.
    until a screenshot shows it correct. A setting that parses is not a setting that looks right.
 4. **Screenshots are the user's screen.** Capture as little as proves the change, keep the file out
    of the user's folders, and delete it afterwards (step 3).
-5. **`just niri` is the user's to run.** It activates the machine you are on through
-   `nixos-rebuild --sudo` and blocks on a password prompt.
+5. **`just niri` is the user's to run.**
 
 ## 1. Pick the layer
 

.agents/skills/nix-config-new-host/SKILL.md

@@ -95,8 +95,7 @@ check every configuration and which list hosts by name:
 - Remote hosts: `just col <tag>` or the host's own recipe, once its key is a secrets recipient.
   Deploying is a separate impactful action; use the `nix-config-update` skill's staged deployment
   (confirm the target, preview the closure, and get authorization).
-- The machine you are on: `just local` or `just niri`, which prompt for `sudo`, so the user runs
-  them.
+- The machine you are on: the user runs `just local` or `just niri`.
 
 ## 5. Verify
 

.agents/skills/nix-config-update/SKILL.md

@@ -111,8 +111,7 @@ for unexpected removals, major-version jumps, and kernel or systemd changes that
 Modes are `switch` (take effect now, the default) and `boot` (only the next boot). Add `debug` for
 verbose output. Anything else is rejected.
 
-Activating the machine you are on runs `nixos-rebuild --sudo` (or `sudo -E darwin-rebuild`) and
-blocks on a password prompt. **An agent cannot run these; they are for the user to run by hand.**
+The user runs these for the machine you are on:
 
 - Current desktop: `just niri [mode] [verbosity]`
 - Other local NixOS host: `just local [mode] [verbosity]`