Resolve all statix and nixpkgs-fmt warnings repo-wide

Zero W20 (repeated attribute keys), W10 (empty { ... }: variadic
pattern, use _: instead), and W04 (a = x.a instead of inherit)
warnings remain anywhere in the tree, and nixpkgs-fmt --check is
clean on all 46 .nix files.

Repeated-key merges go as deep as statix actually flags per file
(e.g. boot.loader.* nested under boot.loader = { ... } once the
outer boot.* merge exposed it as its own repeat) — every merge is a
pure attribute-path restructuring with no value changes, verified by
comparing config.system.build.toplevel.drvPath before/after for a
representative host per changed module plus a full 19-host + 4-package
eval sweep.

One indentation slip caught and fixed during this pass: nesting
modules/installer/common.nix's environment.etc."auto-install.sh".text
under an environment = { ... } block initially normalized the
script's shebang/set line indentation, which actually changes the
rendered file (Nix's '' string dedent treats it as real content, not
cosmetic whitespace) — reproduced the original's exact indentation
and reverified the rendered script is byte-identical to before.

modules/services/zfs/auto-mount-volumes.nix picked up formatting too;
worth noting it isn't imported by anything in this flake at all.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

modules/platforms/lxc.nix

@@ -1,30 +1,36 @@
 { lib, ... }:
 
 {
-  boot.isContainer = true;
+  boot = {
+    isContainer = true;
 
-  boot.loader.grub.enable = false;
-  boot.loader.systemd-boot.enable = false;
+    loader = {
+      grub.enable = false;
+      systemd-boot.enable = false;
 
-  # LXC containers share the host kernel — Proxmox starts them by exec'ing
-  # /sbin/init directly, no bootloader/initrd involved. Without this, that
-  # file doesn't correctly launch the current generation, so even a
-  # correctly-installed system can fail to come up after reboot.
-  boot.loader.initScript.enable = true;
+      # LXC containers share the host kernel — Proxmox starts them by exec'ing
+      # /sbin/init directly, no bootloader/initrd involved. Without this, that
+      # file doesn't correctly launch the current generation, so even a
+      # correctly-installed system can fail to come up after reboot.
+      initScript.enable = true;
+    };
+  };
 
-  # boot.isContainer disables services.udev (see nixpkgs'
-  # virtualisation/container-config.nix), and NetworkManager depends on a
-  # running udevd to enumerate/classify devices. That leaves NM unable to
-  # reliably manage the container's veth interface, which is what broke
-  # DHCP-hostname registration in Pi-hole. systemd-networkd talks to the
-  # kernel over rtnetlink directly and doesn't have that dependency.
-  networking.networkmanager.enable = lib.mkForce false;
-  networking.useNetworkd = true;
+  networking = {
+    # boot.isContainer disables services.udev (see nixpkgs'
+    # virtualisation/container-config.nix), and NetworkManager depends on a
+    # running udevd to enumerate/classify devices. That leaves NM unable to
+    # reliably manage the container's veth interface, which is what broke
+    # DHCP-hostname registration in Pi-hole. systemd-networkd talks to the
+    # kernel over rtnetlink directly and doesn't have that dependency.
+    networkmanager.enable = lib.mkForce false;
+    useNetworkd = true;
 
-  # container-config.nix also defaults this to true, which assumes a
-  # systemd-nspawn-style host bind-mount of /etc/resolv.conf. Real Proxmox
-  # LXC doesn't do that (nixpkgs' own virtualisation/proxmox-lxc.nix module
-  # forces this false for the same reason), so leaving it true silently
-  # breaks DNS instead of falling back to networkd/DHCP-provided servers.
-  networking.useHostResolvConf = lib.mkForce false;
+    # container-config.nix also defaults this to true, which assumes a
+    # systemd-nspawn-style host bind-mount of /etc/resolv.conf. Real Proxmox
+    # LXC doesn't do that (nixpkgs' own virtualisation/proxmox-lxc.nix module
+    # forces this false for the same reason), so leaving it true silently
+    # breaks DNS instead of falling back to networkd/DHCP-provided servers.
+    useHostResolvConf = lib.mkForce false;
+  };
 }