Fix LXC deployment path and clean up remaining eval warnings

LXC hosts (device busy fix):

modules/platforms/lxc.nix now imports nixpkgs' own
virtualisation/proxmox-lxc.nix, giving every lxc-* host a real
config.system.build.tarball output — a directly `pct restore`-able
Proxmox container image. This is the actual bug fix behind the
"cannot remove real root directory: device busy or in use" error:
lxc-* targets were only reachable through nixos-install, which
bind-mounts / onto /mnt for containers (no raw disk to partition)
and then correctly refuses to modify the filesystem it's currently
running on. auto-install.sh's menu now excludes lxc-* targets
entirely (they deploy via nix build + pct restore instead, see
docs/auto-installer.md) — and, on the same reasoning, also excludes
`installer`/`proxmox-lxc`, which are the installer image's own flake
targets, not deployable hosts.

manageHostName = true keeps host.nix's declared hostnames (upstream's
default would let Proxmox's ambient container config win instead);
privileged = false matches how these containers are actually created.

Eval warnings, now zero across all 19 nixosConfigurations + 4 packages:

- Multiple password options (root/nixos in the installer): nixpkgs'
  own installer profile sets initialHashedPassword = "" for
  passwordless login, conflicting with our explicit hashedPassword.
  Force-nulled the upstream option rather than adopting passwordless
  login, since this image now also boots over LAN PXE with
  PasswordAuthentication enabled.
- boot.zfs.forceImportRoot default value: set explicitly to false
  (matching the two places that already did) in
  modules/common/configuration.nix and modules/installer/common.nix,
  covering every host and the installer alike.
- Deprecated pkgs.system in modules/build-types/gui.nix: switched to
  pkgs.stdenv.hostPlatform.system.

All confirmed non-behavioral where it matters: unrelated hosts'
drvPaths are byte-identical to their pre-existing baselines throughout.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

modules/platforms/lxc.nix

@@ -1,36 +1,38 @@
-{ lib, ... }:
+{ lib, modulesPath, ... }:
 
 {
-  boot = {
-    isContainer = true;
+  # LXC containers share the host kernel — Proxmox starts them by exec'ing
+  # /sbin/init directly, no bootloader/initrd involved — and Proxmox has its
+  # own container hostname/network provisioning outside Nix. nixpkgs' own
+  # virtualisation/proxmox-lxc.nix module already handles all of this
+  # correctly (boot.isContainer, loader.initScript, systemd-networkd) and,
+  # critically, provides config.system.build.tarball — a directly
+  # `pct restore`-able container image, no nixos-install/bind-mount needed
+  # (nixos-install refuses to touch the filesystem it's currently running
+  # on, which is exactly what bind-mounting / onto /mnt for an installer
+  # LXC container does).
+  imports = [
+    (modulesPath + "/virtualisation/proxmox-lxc.nix")
+  ];
 
-    loader = {
-      grub.enable = false;
-      systemd-boot.enable = false;
-
-      # LXC containers share the host kernel — Proxmox starts them by exec'ing
-      # /sbin/init directly, no bootloader/initrd involved. Without this, that
-      # file doesn't correctly launch the current generation, so even a
-      # correctly-installed system can fail to come up after reboot.
-      initScript.enable = true;
-    };
+  proxmoxLXC = {
+    # host.nix declares each host's real hostname (networking.hostName);
+    # keep that instead of letting Proxmox's ambient container config win.
+    manageHostName = true;
+    # Unprivileged matches how these containers are actually created.
+    privileged = false;
   };
 
-  networking = {
-    # boot.isContainer disables services.udev (see nixpkgs'
-    # virtualisation/container-config.nix), and NetworkManager depends on a
-    # running udevd to enumerate/classify devices. That leaves NM unable to
-    # reliably manage the container's veth interface, which is what broke
-    # DHCP-hostname registration in Pi-hole. systemd-networkd talks to the
-    # kernel over rtnetlink directly and doesn't have that dependency.
-    networkmanager.enable = lib.mkForce false;
-    useNetworkd = true;
-
-    # container-config.nix also defaults this to true, which assumes a
-    # systemd-nspawn-style host bind-mount of /etc/resolv.conf. Real Proxmox
-    # LXC doesn't do that (nixpkgs' own virtualisation/proxmox-lxc.nix module
-    # forces this false for the same reason), so leaving it true silently
-    # breaks DNS instead of falling back to networkd/DHCP-provided servers.
-    useHostResolvConf = lib.mkForce false;
+  boot.loader = {
+    grub.enable = false;
+    systemd-boot.enable = false;
   };
+
+  # NetworkManager depends on a running udevd to enumerate/classify devices,
+  # which boot.isContainer disables (see nixpkgs' container-config.nix) —
+  # that's what broke DHCP-hostname registration in Pi-hole. The imported
+  # proxmox-lxc.nix module already switches networking to systemd-networkd
+  # for the same reason; it just doesn't disable NetworkManager itself,
+  # which modules/common/configuration.nix enables for every host.
+  networking.networkmanager.enable = lib.mkForce false;
 }