Resolve all statix and nixpkgs-fmt warnings repo-wide

Zero W20 (repeated attribute keys), W10 (empty { ... }: variadic
pattern, use _: instead), and W04 (a = x.a instead of inherit)
warnings remain anywhere in the tree, and nixpkgs-fmt --check is
clean on all 46 .nix files.

Repeated-key merges go as deep as statix actually flags per file
(e.g. boot.loader.* nested under boot.loader = { ... } once the
outer boot.* merge exposed it as its own repeat) — every merge is a
pure attribute-path restructuring with no value changes, verified by
comparing config.system.build.toplevel.drvPath before/after for a
representative host per changed module plus a full 19-host + 4-package
eval sweep.

One indentation slip caught and fixed during this pass: nesting
modules/installer/common.nix's environment.etc."auto-install.sh".text
under an environment = { ... } block initially normalized the
script's shebang/set line indentation, which actually changes the
rendered file (Nix's '' string dedent treats it as real content, not
cosmetic whitespace) — reproduced the original's exact indentation
and reverified the rendered script is byte-identical to before.

modules/services/zfs/auto-mount-volumes.nix picked up formatting too;
worth noting it isn't imported by anything in this flake at all.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

modules/common/configuration.nix

@@ -33,17 +33,23 @@
   # or docs/ for the sops workflow). hashedPassword/hashedPasswordFile need
   # neededForUsers so they're available before the normal secret-activation
   # step, since user creation happens very early in boot.
-  sops.defaultSopsFile = ../../secrets/common.yaml;
-  sops.secrets."root-hashedPassword".neededForUsers = true;
-  sops.secrets."nixos-hashedPassword".neededForUsers = true;
-  sops.secrets."nix-github-token" = { };
+  sops = {
+    defaultSopsFile = ../../secrets/common.yaml;
+
+    secrets = {
+      "root-hashedPassword".neededForUsers = true;
+      "nixos-hashedPassword".neededForUsers = true;
+      "nix-github-token" = { };
+    };
+
+    # nix.conf doesn't support a *File-style option for access-tokens, so the
+    # token is rendered into a runtime-only file (never touches the Nix store)
+    # and pulled in via nix.conf's native !include directive.
+    templates."nix-github-token.conf".content = ''
+      access-tokens = github.com=${config.sops.placeholder."nix-github-token"}
+    '';
+  };
 
-  # nix.conf doesn't support a *File-style option for access-tokens, so the
-  # token is rendered into a runtime-only file (never touches the Nix store)
-  # and pulled in via nix.conf's native !include directive.
-  sops.templates."nix-github-token.conf".content = ''
-    access-tokens = github.com=${config.sops.placeholder."nix-github-token"}
-  '';
   nix.extraOptions = ''
     !include ${config.sops.templates."nix-github-token.conf".path}
   '';
@@ -62,7 +68,7 @@
     ];
     hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path;
     openssh.authorizedKeys.keys = [
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCq/Q5LvIXlZwO2kdeAN5nLGZ59nZB7JHYMEszHxmNtGMzv1lM31jiPNsr0z2EKVZhE7OOfa2IF9rhWYD7JUA9G0yzdZ4WTXFNGVVOJoOVH6vAF3XCxoVilOEwTc7h2Wiy+rzd0B28/3spffzQQWJhY6GRQVa8j+6xAGF60Fcvl1vLosYT9Bn2ZbK4TCWOwAn2jqXIieGpZdn/UNZbGOeKRiCvhktDfMAzuQzN/9jMu/oF4pkPn2X1UrsQdNlvp0Ci8md612MozIpncQJyAF1ADhunr3sMx0isUXiqD29R5DS4TftpekqLNLak+zcxFa8N7DcRNp3DcKfJvyTkwQrR4r+b7lFLYOLHLagSso9CzeW/paAS2q9I5SBm/2DtE1diLLg2jZikYcstsu/G5RgvbzbKqjiaMwTdXC3AMvDxQrs7U5pDRZFzoofG3cpODbTm+uy3m0kP70z0M1K45UbDG0p+itnTu9x40JbQEgefbx38AItNvAIx1A8HO4I1VX28= wayne@stream"
+      vars.adminSshKey
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
     ];
   };

modules/common/home.nix

@@ -10,9 +10,25 @@ in
     ./aliases.nix
   ];
 
-  home.username = vars.primaryUser;
-  home.homeDirectory = "/home/${vars.primaryUser}";
-  home.stateVersion = "25.11"; # match your NixOS stateVersion
+  home = {
+    username = vars.primaryUser;
+    homeDirectory = "/home/${vars.primaryUser}";
+    stateVersion = "25.11"; # match your NixOS stateVersion
+
+    # Optional: packages
+    packages = with pkgs; [
+      git
+      vim
+      tmux
+      nano
+      sshfs
+    ];
+
+    # Optional: set environment vars
+    sessionVariables = {
+      EDITOR = "nano";
+    };
+  };
 
   programs.home-manager.enable = true; # mandatory to activate HM
 
@@ -23,19 +39,6 @@ in
   # modules/common/configuration.nix instead (covers the daemon for every
   # user, not just this one).
 
-  # Optional: packages
-  home.packages = with pkgs; [
-    git
-    vim
-    tmux
-    nano
-    sshfs
-  ];
-
-  # Optional: set environment vars
-  home.sessionVariables = {
-    EDITOR = "nano";
-  };
   #  systemd.user.services.mount-proxmox-iso = {
   #    Unit = {
   #      Description = "Mount Proxmox ISO dir via SSHFS";

modules/common/set-locale.nix

@@ -1,4 +1,4 @@
-{ ... }:
+_:
 
 {
   i18n.defaultLocale = "en_AU.UTF-8";
@@ -15,4 +15,4 @@
     LC_TIME = "en_AU.UTF-8";
   };
 
-}
+}