Deduplicate reusable shell code in scripts/ into scripts/lib/

Three chunks of copy-pasted logic were drifting across scripts/*.sh:
- codex-setup.sh and codex-maintenance.sh each carried an identical
  NIX_CONFIG bootstrap + ensure_nix_profile() -> scripts/lib/nix-bootstrap.sh
- sync-host-keys.sh and prepare-host-key.sh each ran the same
  ssh-keygen/ssh-to-age nix-shell invocations -> scripts/lib/ssh-host-keys.sh
  (prepare-host-key.sh now also calls env.sh's nix_extra_opts before using
  them, closing a gap where it alone skipped the nix-cache reachability
  check env.sh exists for)
- the "list nixosConfigurations attrNames" / "get one target's hostName"
  nix eval pattern was repeated across codex-setup.sh, codex-maintenance.sh,
  sync-host-keys.sh and create-proxmox-resource.sh (the latter twice, in
  its own --list and --host lookup) -> scripts/lib/nix-eval.sh, which also
  centralizes the --no-use-registries --no-accept-flake-config flag pair
  used on every such call

Verified against the real flake/node config (nix is available here):
create-proxmox-resource.sh --list for both --type lxc/vm, a full
--dry-run create, and prepare-host-key.sh generating and cleaning up a
real key/age-pubkey pair.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/create-proxmox-resource.sh

@@ -26,6 +26,8 @@ set -euo pipefail
 repo_root="$(cd "$(dirname "$0")/.." && pwd)"
 # shellcheck source=env.sh
 source "${repo_root}/scripts/env.sh"
+# shellcheck source=lib/nix-eval.sh
+source "${repo_root}/scripts/lib/nix-eval.sh"
 
 sync_keys="${repo_root}/scripts/sync-host-keys.sh"
 
@@ -240,15 +242,21 @@ platform_prefix="lxc"
 [[ -z "$memory" ]] && memory="$PROXMOX_DEFAULT_MEMORY_MB"
 
 # --- discover / resolve the flake target from --host --------------------
+# Emits "<target>\t<hostName>" pairs for every ${platform_prefix}-* flake
+# target -- the one source both --list and the --host lookup below read
+# from, so they can never see a different set of targets from each other.
+targets_for_platform() {
+  local target
+  for target in $(list_flake_targets "$repo_root" 2>/dev/null | grep -- "^${platform_prefix}-"); do
+    printf '%s\t%s\n' "$target" "$(flake_target_hostname "$repo_root" "$target")"
+  done
+}
+
 list_hosts() {
   local target hostname
-  for target in $(nix eval --json --no-use-registries --no-accept-flake-config \
-    "${repo_root}#nixosConfigurations" --apply builtins.attrNames 2>/dev/null \
-    | jq -r --arg p "${platform_prefix}-" '.[] | select(startswith($p))'); do
-    hostname="$(nix eval --raw --no-use-registries --no-accept-flake-config \
-      "${repo_root}#nixosConfigurations.${target}.config.networking.hostName" 2>/dev/null)"
+  while IFS=$'\t' read -r target hostname; do
     printf '  %-12s -> %s\n' "$hostname" "$target"
-  done
+  done < <(targets_for_platform)
 }
 
 if [[ "$do_list" -eq 1 ]]; then
@@ -263,16 +271,12 @@ if [[ -z "$host" ]]; then
 fi
 
 flake_target=""
-for target in $(nix eval --json --no-use-registries --no-accept-flake-config \
-  "${repo_root}#nixosConfigurations" --apply builtins.attrNames \
-  | jq -r --arg p "${platform_prefix}-" '.[] | select(startswith($p))'); do
-  hn="$(nix eval --raw --no-use-registries --no-accept-flake-config \
-    "${repo_root}#nixosConfigurations.${target}.config.networking.hostName")"
-  if [[ "$hn" == "$host" ]]; then
+while IFS=$'\t' read -r target hostname; do
+  if [[ "$hostname" == "$host" ]]; then
     flake_target="$target"
     break
   fi
-done
+done < <(targets_for_platform)
 
 if [[ -z "$flake_target" ]]; then
   echo "ERROR: no ${platform_prefix}-* target has hostName '${host}'." >&2