Fix LXC installs never actually activating (bind-mount / onto /mnt)

LXC containers have no raw disk visible from inside them, only their
already-mounted root filesystem, so hosts like lxc-minimal have no
disko config and auto-install.sh's disko branch was a no-op. With
nothing pointing /mnt at anything, nixos-install (which defaults to
--root /mnt) built the new system into a disconnected empty directory
on the container's own root — never the filesystem it actually boots
from. After reboot, Proxmox just re-execs the *original* /sbin/init,
so the container silently keeps running the installer environment
forever, with the "installed" system sitting inert and unused.

Confirmed on a real lxc-minimal attempt: /etc/flake-target (stamped by
every nixos flake target) didn't exist post-"install", the only SSH
key present matched this installer's own common.nix rather than the
target flake's modules/common/configuration.nix, and sshd was still
socket-activated (nixpkgs' proxmox-lxc.nix default) rather than
running as the target's plain sshd.service.

Fix: bind-mount / onto /mnt when there's no disko config, so
nixos-install actually lands on the filesystem the container boots
from — installing NixOS in place rather than into a void.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

common.nix

@@ -5,6 +5,24 @@
 
   time.timeZone = "Australia/Brisbane";
 
+  # Without this, the installer only ever sees cache.nixos.org, which
+  # doesn't carry sops-install-secrets (it's built straight from the
+  # sops-nix flake's own Go source, not part of nixpkgs) — every install
+  # would otherwise compile it from scratch, which is what ran an 8GB LXC
+  # container's disk out of space. Push a built copy to nix-cache once
+  # (from a machine with real disk headroom) and every future install,
+  # of any type, fetches instead of rebuilding.
+  nix.settings = {
+    substituters = [
+      "http://nix-cache"
+      "https://cache.nixos.org/"
+    ];
+    trusted-public-keys = [
+      "cache.local-1:usoWYanY3Kpq2+kDIS2nhWoLZiRxanmdysdzqCFBHW4="
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+    ];
+  };
+
   environment.systemPackages = with pkgs; [
     git
     curl
@@ -120,7 +138,16 @@ if nix eval --refresh --json  --extra-experimental-features "flakes nix-command"
     disko --mode destroy,format,mount \
         --flake "''${FLAKE_BASE_URL}#''${choice}" --yes
 else
-    echo "Selected host has no Disko configuration."
+    # No raw disk to partition — true for every LXC container, which has
+    # no block device visible from inside it, only its already-mounted
+    # root filesystem. nixos-install defaults to installing into /mnt; if
+    # nothing points /mnt at the real root, the new system gets built and
+    # written to a disconnected empty directory, never actually becomes
+    # bootable, and the container silently keeps running this installer
+    # environment forever. Bind-mount / onto /mnt so the install actually
+    # lands on the filesystem this container boots from.
+    echo "Selected host has no Disko configuration — installing in place via bind mount."
+    mount --bind / /mnt
 fi
 
 # sops-nix derives this host's decryption key from its own SSH host key