updated documentation

docs/flake-lock-automation.md

@@ -1,6 +1,7 @@
 # flake.lock automation
 
-This repository uses CI workflows to keep `flake.lock` up to date on a schedule and to verify that all declared NixOS hosts still evaluate after dependency updates.
+This repository uses CI workflows to keep `flake.lock` up to date on a schedule
+and to verify that declared NixOS hosts still evaluate after dependency updates.
 
 ## What this automation does
 
@@ -14,6 +15,7 @@ This repository uses CI workflows to keep `flake.lock` up to date on a schedule
   - `server`
   - `nix-cache`
   - `nix-minimal`
+  - `pxe-boot`
 
 ## Why hosts should stop using `--upgrade-all`
 
@@ -27,6 +29,9 @@ sudo nixos-rebuild switch --flake git+https://gitea.lan.ddnsgeek.com/beatzaplent
 
 Using the committed lock file keeps all hosts aligned and makes updates auditable through CI and code review.
 
+Codex and automated review sessions must not run rebuilds. Limit checks to
+evaluation, linting, formatting, and dry-run builds.
+
 ## Command differences
 
 - `nix flake update`