refactor(youko): disable HDD spindown from a udev rule

Apply hdparm -B 255 -S 0 whenever a disk appears, which also covers the
re-add after a bridge reset, instead of a boot oneshot plus an hourly
timer. Drop -J 0: hdparm has always aborted it without
--please-destroy-my-drive, and wdidle3 already reads disabled on both
disks (it is persistent firmware state).

This was the last user of mylib.systemdHardening.privilegedOneshot, so
remove the preset and its test group.

Assisted-by: Claude Code (claude-opus-5-5)

lib/systemdHardening.nix

@@ -42,37 +42,6 @@ rec {
     ];
   };
 
-  # For short-lived root oneshots that perform one narrowly scoped privileged
-  # operation. Callers add only the capabilities and device access they need.
-  # ProtectKernelTunables is deliberately unset because it makes /sys read-only.
-  privilegedOneshot = {
-    AmbientCapabilities = "";
-    CapabilityBoundingSet = "";
-    LockPersonality = true;
-    MemoryDenyWriteExecute = true;
-    NoNewPrivileges = true;
-    PrivateDevices = true;
-    PrivateMounts = true;
-    PrivateNetwork = true;
-    PrivateTmp = true;
-    ProcSubset = "pid";
-    ProtectClock = true;
-    ProtectControlGroups = true;
-    ProtectHome = true;
-    ProtectHostname = true;
-    ProtectKernelLogs = true;
-    ProtectKernelModules = true;
-    ProtectProc = "invisible";
-    ProtectSystem = "strict";
-    RemoveIPC = true;
-    RestrictAddressFamilies = [ "AF_UNIX" ];
-    RestrictNamespaces = true;
-    RestrictRealtime = true;
-    RestrictSUIDSGID = true;
-    SystemCallArchitectures = "native";
-    UMask = "0077";
-  };
-
   # Apply a preset at mkOptionDefault priority, so nixpkgs module values win.
   mkDefaults = lib.mapAttrs (_: lib.mkOptionDefault);
 }