fix(lxc): move sops-reinstall service from sysinit to network.target

nixos-lxc-sops-reinstall.service called switch-to-configuration test at
sysinit.target time (DefaultDependencies=false), before D-Bus was up.
D-Bus is required to restart systemd targets after activation scripts
run. The service reported failure on every boot (exit 1: "Failed to open
dbus connection") even though secrets were correctly installed, because
the D-Bus call happens after activation scripts complete.

Move the service to network.target so basic.target (which includes
dbus-broker.service) runs first. Also drop DefaultDependencies=false so
systemd auto-adds After=basic.target. Add SuccessExitStatus=11 to handle
the edge case where switch-to-configuration holds the lock during a
concurrent rebuild (exit 11 = "Could not acquire lock" -- the rebuild's
own activation already installed the secrets, so treating it as success
is correct).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx

modules/platforms/lxc.nix

@@ -217,28 +217,32 @@ in
   # are permanently absent after the first boot and every service that
   # reads from /run/secrets fails on start.
   #
-  # wantedBy/before sysinit.target + DefaultDependencies=false mirrors how
+  # wantedBy/before network.target: switch-to-configuration test requires
-  # the sops-nix module places its own service when it generates one. This
+  # D-Bus to restart systemd targets after running activation scripts. D-Bus
-  # ensures secrets exist before basic.target (and thus before any user
+  # is available once basic.target completes (the default After=basic.target
-  # service) starts. DefaultDependencies=false is required to avoid a
+  # that DefaultDependencies would otherwise add). Placing the service before
-  # circular ordering: without it, systemd would add After=sysinit.target
+  # network.target ensures secrets are ready before any network-dependent
-  # to a service that is itself part of sysinit.target.
+  # service (including beszel-agent and nix-serve) starts, while running late
+  # enough that D-Bus is already up.
   #
   # ConditionPathExists=... skips this service on the genuine first boot
   # (the marker doesn't exist yet); nixos-lxc-first-boot-activate handles
   # that case. On every subsequent boot the condition passes and secrets
   # are reinstalled before user services start.
+  #
+  # SuccessExitStatus=11: switch-to-configuration exits 11 when it cannot
+  # acquire the activation lock (another switch is already in progress).
+  # During a nixos-rebuild switch the activation already installs secrets, so
+  # treating the lock-held case as success is correct.
   systemd.services.nixos-lxc-sops-reinstall = {
     description = "Reinstall sops secrets on each non-first boot (LXC, /run is tmpfs)";
-    wantedBy = [ "sysinit.target" ];
+    wantedBy = [ "network.target" ];
-    before = [ "sysinit.target" ];
+    before = [ "network.target" ];
-    unitConfig = {
+    unitConfig.ConditionPathExists = "/var/lib/nixos-lxc-first-boot-activated";
-      DefaultDependencies = false;
-      ConditionPathExists = "/var/lib/nixos-lxc-first-boot-activated";
-    };
     serviceConfig = {
       Type = "oneshot";
       RemainAfterExit = true;
+      SuccessExitStatus = "11";
     };
     script = ''
       /run/current-system/bin/switch-to-configuration test