chore(agents): workspace layout, related repositories, and ~/src checkouts (#340)

* docs(skills): point nix-config-secrets at the private repo under ~/codes

Record where the private nix-secrets checkout lives and that agents should
do the mechanical secret work themselves, handing back only the
interactive/sudo agenix operations and pushes.

* docs(agents): add related repositories to nix-config

* chore(agents): adopt ~/src for source checkouts

Move third-party/source checkouts from ~/codes/src to ~/src so the home
layout reads as three siblings: ~/codes (personal), ~/work (work),
~/src (checkouts). Preserve and back up the new path, and update the
global rule and the two nixpkgs skill references.

* docs(agents): tighten the code layout rule

* docs(agents): fold the work-confidentiality note into the layout line

* docs(agents): base the confidentiality rule on repo visibility

* docs(agents): drop the stale KubeVirt mention

AGENTS.md

@@ -100,6 +100,21 @@ is discovered by OpenCode and compatible tools.
 - [`.agents/skills/nixpkgs-patched/SKILL.md`](./.agents/skills/nixpkgs-patched/SKILL.md) — carrying
   selected unmerged nixpkgs changes through the personal patched fork safely.
 
+## Related Repositories
+
+When a change here affects one of these, make both edits in the same task, one branch or PR per
+repository, and cross-link them — no need to be told.
+
+- `~/codes/k8s-gitops` — Flux cluster state for the k3s cluster whose hosts are defined in
+  `hosts/k8s` and `hosts/12kingdoms-youko` (NFS golden store, kube-vip block, `br0`). Host
+  networking, VM images, or cluster addons usually change both repositories together.
+- `~/codes/containers` — container images consumed by k8s-gitops; a tag bump is often a two-repo
+  change.
+- `~/codes/nix-secrets` — agenix files and recipients for secrets declared here (see the
+  `nix-config-secrets` skill).
+- `wallpapers`, `nur-packages`, `pyclipsync`, `nu_scripts` — flake inputs; bump with
+  `just upp <input>` after their source changes, do not edit them from here.
+
 ## Further Context
 
 - [Repository overview](./README.md)