refactor: host profiles; give ruby, kana and aquamarine the TUI home (#512)

- Add the agent profile (modules/nixos/agent.nix: rootless Podman, linger,
  nix-ld) with home/linux/tui.nix as its home role; ruby, kana and
  aquamarine use it, so hosts no longer import from hosts/idols-ruby.
- Gate nushell's ~/.secrets source behind modules.shell.secrets.enable,
  off on agent hosts.
- Persist the TUI home state on aquamarine's tmpfs root.
- Document host profiles in hosts/README.md; add tests/agent-profile and
  drop the x86_64 colmena-parity test, which needs mysecrets.

Assisted-by: Claude Code (claude-opus-5-5)

home/linux/gui/i3/README.md

@@ -46,8 +46,9 @@ tree the agent reads, so it stays.
   the systemd user manager, clears any stale `WAYLAND_DISPLAY`, and enables the AT-SPI bridge via a
   gsettings key.
 - Drivers come from the nur-ryan4yin overlay (`overlays/nur-ryan4yin.nix`).
-- Host wiring: `home/hosts/linux/idols-ruby.nix`, `home/hosts/linux/idols-kana.nix`,
-  `hosts/idols-ruby/computer-use.nix`.
+- Wiring: the `agent` profile imports both sides, off by default
+  ([Host Profiles](../../../../hosts/README.md#host-profiles));
+  `hosts/idols-{ruby,kana}/default.nix` and `home/hosts/linux/idols-{ruby,kana}.nix` turn them on.
 
 ## The i3 config
 

home/linux/tui.nix

@@ -1,3 +1,5 @@
+# Home role of the `agent` profile (hosts/README.md#host-profiles): the full
+# TUI stack for a headless host.
 {
   imports = [
     ../base/core
@@ -5,5 +7,10 @@
     ../base/home.nix
 
     ./base
+    # off by default; a host turns it on with modules.desktop.computerUse.enable
+    ./gui/i3
   ];
+
+  # ~/.secrets is synced to the desktops only.
+  modules.shell.secrets.enable = false;
 }