Resolve all statix and nixpkgs-fmt warnings repo-wide

Zero W20 (repeated attribute keys), W10 (empty { ... }: variadic
pattern, use _: instead), and W04 (a = x.a instead of inherit)
warnings remain anywhere in the tree, and nixpkgs-fmt --check is
clean on all 46 .nix files.

Repeated-key merges go as deep as statix actually flags per file
(e.g. boot.loader.* nested under boot.loader = { ... } once the
outer boot.* merge exposed it as its own repeat) — every merge is a
pure attribute-path restructuring with no value changes, verified by
comparing config.system.build.toplevel.drvPath before/after for a
representative host per changed module plus a full 19-host + 4-package
eval sweep.

One indentation slip caught and fixed during this pass: nesting
modules/installer/common.nix's environment.etc."auto-install.sh".text
under an environment = { ... } block initially normalized the
script's shebang/set line indentation, which actually changes the
rendered file (Nix's '' string dedent treats it as real content, not
cosmetic whitespace) — reproduced the original's exact indentation
and reverified the rendered script is byte-identical to before.

modules/services/zfs/auto-mount-volumes.nix picked up formatting too;
worth noting it isn't imported by anything in this flake at all.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

modules/nix-cache/remote-builder-client.nix

@@ -5,22 +5,24 @@
   #   sudo install -d -m 0700 /root/.ssh
   #   sudo install -m 0600 ./nixremote /root/.ssh/nixremote
   #   sudo ssh -i /root/.ssh/nixremote nixremote@nix-cache nix-store --version
-  nix.distributedBuilds = true;
+  nix = {
+    distributedBuilds = true;
 
-  nix.buildMachines = [
-    {
-      hostName = vars.nixCacheHost;
-      sshUser = vars.remoteBuilderUser;
-      sshKey = "/root/.ssh/${vars.remoteBuilderUser}";
-      system = pkgs.stdenv.hostPlatform.system;
-      maxJobs = 4;
-      speedFactor = 2;
-      supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
-    }
-  ];
+    buildMachines = [
+      {
+        hostName = vars.nixCacheHost;
+        sshUser = vars.remoteBuilderUser;
+        sshKey = "/root/.ssh/${vars.remoteBuilderUser}";
+        inherit (pkgs.stdenv.hostPlatform) system;
+        maxJobs = 4;
+        speedFactor = 2;
+        supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
+      }
+    ];
 
-  nix.settings = {
-    builders-use-substitutes = true;
-    max-jobs = "auto";
+    settings = {
+      builders-use-substitutes = true;
+      max-jobs = "auto";
+    };
   };
 }

modules/nix-cache/server.nix

@@ -9,19 +9,23 @@
   #   sudo chmod 0600 /etc/nix/cache-priv.pem
   #   sudo chmod 0644 /etc/nix/cache-pub.pem
   #   cat /etc/nix/cache-pub.pem
-  services.nix-serve = {
-    enable = true;
-    secretKeyFile = "/etc/nix/cache-priv.pem";
-  };
+  services = {
+    nix-serve = {
+      enable = true;
+      secretKeyFile = "/etc/nix/cache-priv.pem";
+    };
 
-  services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
-    virtualHosts.${vars.nixCacheHost} = {
-      locations."/" = {
-        proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
+    nginx = {
+      enable = true;
+      recommendedProxySettings = true;
+      virtualHosts.${vars.nixCacheHost} = {
+        locations."/" = {
+          proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
+        };
       };
     };
+
+    openssh.enable = true;
   };
 
   networking.firewall.allowedTCPPorts = [ 80 ];
@@ -40,8 +44,6 @@
     openssh.authorizedKeys.keys = vars.remoteBuilderAuthorizedKeys;
   };
 
-  services.openssh.enable = true;
-
   nix.settings = {
     trusted-users = [ "root" vars.remoteBuilderUser ];
     experimental-features = [ "nix-command" "flakes" ];