docs: warn that user-readable decrypted secrets must not be read (#303)

Only three secrets are readable as the login user (nix-access-tokens,
ssh-key-romantic and the nushell one); everything else is root-only and
the filesystem already keeps agents out.

home/base/tui/shell/default.nix

@@ -10,7 +10,7 @@
     # currently, nushell does not support conditional sourcing of files
     # https://github.com/nushell/nushell/issues/8214
     extraConfig = ''
-      # decrypted secret: AI agents must not read the sourced file, only reference the path
+      # decrypted secret: AI agents must not read it
       source /etc/agenix/nushell-secrets.nu
 
       # Directories in this constant are searched by the

home/base/tui/ssh.nix

@@ -35,6 +35,7 @@
 
       "192.168.*" = {
         ForwardAgent = true;
+        # decrypted secret: AI agents must not read it
         IdentityFile = "/etc/agenix/ssh-key-romantic";
         IdentitiesOnly = true;
       };

modules/darwin/nix-core.nix

@@ -27,6 +27,7 @@
   system.stateVersion = 5;
 
   nix.extraOptions = ''
+    # decrypted secret: AI agents must not read it
     !include ${config.age.secrets.nix-access-tokens.path}
   '';
 }

modules/nixos/base/remote-building.nix

@@ -17,7 +17,7 @@
   nix.buildMachines =
     let
       sshUser = myvars.username;
-      # ssh key's path on local machine
+      # ssh key's path on local machine; a decrypted secret AI agents must not read
       sshKey = "/etc/agenix/ssh-key-romantic";
       systems = [
         # native arch

modules/nixos/desktop/nix.nix

@@ -1,6 +1,7 @@
 { config, ... }:
 {
   nix.extraOptions = ''
+    # decrypted secret: AI agents must not read it
     !include ${config.age.secrets.nix-access-tokens.path}
   '';
 }