Add script to configure nix-cache as substituter/remote builder on Debian clients

Non-NixOS machines with just the Nix package manager installed have no
module system to pick up modules/nix-cache/client.nix, so this edits
/etc/nix/nix.conf directly (extra-substituters/extra-trusted-public-keys,
plus the SSH remote-builder config once the nixremote key is installed),
falling back to cache.nixos.org when nix-cache is unreachable.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -101,6 +101,20 @@ Beyond `codex-setup.sh`/`codex-maintenance.sh` above, `scripts/` also has:
 - `scripts/env.sh` — shared config (`PROXMOX_HOST`, storage pool, bridge,
   default cores/memory) sourced by `create-proxmox-resource.sh`. Add new
   cross-script config here instead of duplicating it per-script.
+- `scripts/configure-nix-cache-client.sh [--dry-run] [--no-remote-builder]
+  [--no-restart]` — the non-NixOS equivalent of
+  `modules/nix-cache/client.nix`/`remote-builder-client.nix`, for a plain
+  Debian machine with the Nix package manager (not NixOS) already
+  installed: run as root *on that machine* to add nix-cache as a
+  substituter in `/etc/nix/nix.conf` (`https://cache.nixos.org/` kept as
+  fallback) via `extra-substituters`/`extra-trusted-public-keys` so it
+  layers on top of whatever's already there instead of clobbering it, and,
+  if `/root/.ssh/nixremote` is already present (see docs/nix-cache.md
+  "Remote builder SSH keys"), configures it as a distributed-build
+  machine too and trusts nix-cache's SSH host key in
+  `/etc/ssh/ssh_known_hosts`. Idempotent (re-running replaces its own
+  marked block rather than duplicating it); restarts `nix-daemon` by
+  default so the change takes effect immediately.
 - `scripts/bump-nixpkgs-release.sh` — bumps `flake.nix`'s `nixpkgs.url`/
   `home-manager.url` in place. Exists because flake input URLs can't
   reference `variables.nix` (confirmed empirically — `nix flake metadata`