Consolidate CI on codex-maintenance.sh; clean up dead scripts and docs

Both check-nixos.yml workflows (GitHub + Gitea) now call
scripts/codex-maintenance.sh instead of a hand-rolled eval-only loop,
closing a real gap: CI previously enforced none of the secret grep,
nixpkgs-fmt, or statix checks that codex-maintenance.sh already runs
locally — nothing was stopping that from regressing. One script now
backs both, instead of two copies that can drift from each other.

codex-maintenance.sh itself is extended to cover buildable surface
that wasn't validated anywhere before: packages.x86_64-linux.*, plus
config.system.build.tarball (lxc-* hosts) and
config.system.build.diskoImagesScript (proxmox-*, excluding the
installer's own proxmox-lxc target, which has no disko config).

Also:
- scripts/prepare-host-key.sh: dropped the redundant
  [path-to-nixos-repo] parameter — it always defaults to the repo the
  script itself lives in now, so a second argument never made sense
  after the nix-auto-installer migration.
- Removed prepare.sh (dead pre-disko manual parted/mkfs/mkswap
  partitioning, fully superseded) and
  scripts/create-linode-installer-disk.sh (incomplete draft for an
  abandoned dd-via-rescue-mode approach; Linode hosts already deploy
  fine through the normal auto-installer flow).
- docs/pxe-boot.md: fixed a stale `nixosConfigurations.pxe-boot` eval
  command (pre-refactor flat name, not a real flake attribute
  anymore) and added a cross-reference to docs/auto-installer.md.
- CLAUDE.md/README.md: full documentation pass reconciling this
  session's changes — modules/installer/, modules/pxe-boot/, the
  LXC/Proxmox image-building deployment paths, corrected the
  password-hash/SSH-key locations in the safety-rules section (both
  had drifted to reference files/paths that no longer exist), and
  added session-workflow guidance to prefer targeted host evals over
  full-repo sweeps for incremental changes (explicitly scoped to
  interactive sessions, not CI).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

scripts/prepare-host-key.sh

@@ -20,12 +20,11 @@ set -euo pipefail
 
 repo_root="$(cd "$(dirname "$0")/.." && pwd)"
 
-hostname="${1:?usage: scripts/prepare-host-key.sh <hostname> [path-to-nixos-repo]}"
-nixos_repo="${2:-$repo_root}"
-sops_yaml="${nixos_repo}/.sops.yaml"
+hostname="${1:?usage: scripts/prepare-host-key.sh <hostname>}"
+sops_yaml="${repo_root}/.sops.yaml"
 
 if [[ ! -f "$sops_yaml" ]]; then
-  echo "ERROR: $sops_yaml not found. Pass the nixos repo path as the 2nd argument." >&2
+  echo "ERROR: $sops_yaml not found — is this script still under nixos/scripts/?" >&2
   exit 1
 fi
 
@@ -55,7 +54,7 @@ Generated: ${keyfile}(.pub)
  nix-cache/server.)
 
 === 3. Re-encrypt every secrets file you just added it to ===
-  nix-shell -p sops --run 'sops updatekeys ${nixos_repo}/secrets/common.yaml'
+  nix-shell -p sops --run 'sops updatekeys ${repo_root}/secrets/common.yaml'
 
 === 4. Commit + push this repo so the flake build picks up the new recipient ===