fix: reinstall nix as SSH user, not root, on Proxmox nodes

nix was installed as root on pve1 (the codex-setup.sh root path, meant
for container/Codex environments), making nix build require sudo there.
After cleaning up the root install and reinstalling as the SSH user
(wayne), nix is owned by that user and runs directly without sudo.

create-proxmox-resource.sh: drop sudo_pfx from nix build in both
remote scripts. The SSH user owns the store after reinstall; nix build
goes through the nix daemon-or-store directly. sudo stays on pct/qm/pvesh
(cluster IPC) and the disko image-writer script (writes to disk).

codex-setup.sh: add build-users-group = (empty) to the user nix.conf
written by the non-root install path. Guards against a stale
/etc/nix/nix.conf from a prior root install (which sets
build-users-group = nixbld) silently breaking single-user builds.

Manual cleanup required once on each Proxmox node that had root's nix:
  sudo rm -rf /nix /etc/nix
  sudo rm -f /etc/profile.d/nix.sh /etc/profile.d/nix-daemon.sh
  for i in $(seq 1 10); do sudo userdel nixbld$i 2>/dev/null||true; done
  sudo groupdel nixbld 2>/dev/null || true
After that, the next create-proxmox-resource.sh run auto-reinstalls
nix as the SSH user via codex-setup.sh.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/codex-setup.sh

@@ -68,6 +68,7 @@ cat > "$HOME/.config/nix/nix.conf" <<'EOF'
 experimental-features = nix-command flakes
 accept-flake-config = false
 warn-dirty = false
+build-users-group =
 EOF
 
 echo "Nix version:"

scripts/proxmox/create-proxmox-resource.sh

@@ -696,7 +696,7 @@ cd "$repo_dir"
 # right after a successful install.
 . scripts/lib/nix-bootstrap.sh
 ensure_nix_profile
-NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" $sudo_pfx nix build --impure \
+NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build --impure \
   --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \
   ".#nixosConfigurations.${target}.config.system.build.tarball" \
   --out-link "result-${target}"
@@ -736,7 +736,7 @@ declare -a NIX_OPTS=()
 cd "$repo_dir"
 . scripts/lib/nix-bootstrap.sh
 ensure_nix_profile
-$sudo_pfx nix build --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \
+nix build --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \
   ".#nixosConfigurations.${target}.config.system.build.diskoImagesScript" \
   --out-link "result-${target}"
 $sudo_pfx "./result-${target}" \