Fix auto-install.sh to work standalone, not just baked into the image

Two real bugs, both hit live:

1. Shebang: #!/run/current-system/sw/bin/bash only resolves on an
   already-activated NixOS system -- running the checked-out script
   directly (e.g. from a stock ISO, cloned repo) failed with "cannot
   execute: required file not found" on a non-NixOS box. Switched to
   #!/usr/bin/env bash, which resolves identically on NixOS
   (environment.usrbinenv's own default) and any normal Linux distro.
   Also fixed the file's missing executable bit.

2. FLAKE_BASE_URL: previously depended on pkgs.replaceVars substituting
   a Nix-templated @lanDomain@ placeholder at build time -- meaning it
   only ever worked when baked into the built installer image, not when
   run straight from a checkout (the literal, unexpanded "@lanDomain@"
   string reached git as a bogus hostname). Replaced with LAN_DOMAIN in
   scripts/env.sh (manually kept in sync with variables.nix's lanDomain,
   same pattern as NIX_CACHE_HOST/nixCacheHost already), sourced by the
   script itself like every other script in scripts/. Dropped
   pkgs.replaceVars from modules/installer/common.nix entirely --
   scripts/env.sh is now baked into the image alongside auto-install.sh
   at a matching relative path (/etc/nixos-installer/env.sh next to
   /etc/nixos-installer/installer/auto-install.sh) so the script's own
   relative `source` line resolves the same way in both contexts.

loginShellInit's invocation path and docs/auto-installer.md updated to
match. Verified: shellcheck clean on both scripts, the baked files are
byte-identical to their checked-in sources (no templating left to
verify), and codex-maintenance.sh (secret grep, fmt, statix, full eval
of every host/package including the installer/pxe artifacts) passes
clean.

CLAUDE.md

@@ -179,13 +179,24 @@ instead of copying it.
 - `scripts/installer/auto-install.sh` — the interactive install script
   baked into the auto-installer image (see `docs/auto-installer.md`), kept
   as a real, version-controlled shell file rather than inline in
-  `modules/installer/common.nix`'s Nix. `common.nix` wires it in with
-  `pkgs.replaceVars ../../scripts/installer/auto-install.sh { inherit (vars) lanDomain; }`,
-  substituting the single `@lanDomain@` placeholder from `variables.nix` —
-  every other `${...}` in the script is a literal bash reference,
-  untouched by this. `replaceVars` fails the build if any `@name@`-shaped
-  placeholder is left unsubstituted, so a typo'd or renamed variable is
-  caught at eval time rather than silently shipping broken.
+  `modules/installer/common.nix`'s Nix. It sources `scripts/env.sh` itself
+  for `LAN_DOMAIN` (`export LAN_DOMAIN`/`: "${LAN_DOMAIN:=...}"`, matching
+  `variables.nix`'s `lanDomain` — manually kept in sync, same pattern as
+  `NIX_CACHE_HOST` mirroring `nixCacheHost`), rather than Nix-level string
+  substitution — that's what makes it work identically whether run
+  straight from a git checkout or from inside the built installer image.
+  `common.nix` bakes `scripts/env.sh` in alongside it at a matching
+  relative path (`/etc/nixos-installer/env.sh` next to
+  `/etc/nixos-installer/installer/auto-install.sh`) so the script's own
+  `source "$(dirname ...)/../env.sh"` line resolves the same way in both
+  contexts — this is also why it's invoked from
+  `/etc/nixos-installer/installer/auto-install.sh` rather than a flat
+  `/etc/auto-install.sh`. `#!/usr/bin/env bash`, not
+  `#!/run/current-system/sw/bin/bash`: the latter only resolves on an
+  already-activated NixOS system, breaking the checked-out-file case
+  entirely (confirmed live: "cannot execute: required file not found" on
+  a non-NixOS box); `/usr/bin/env` is reliably present on both NixOS
+  (`environment.usrbinenv`'s own default) and any normal Linux distro.
 
 ### `scripts/secrets/`
 
@@ -297,8 +308,9 @@ Sourced by the scripts above, never run directly:
 ### Top level
 
 - `scripts/env.sh` — shared config (`PROXMOX_HOST`, storage pool, bridge,
-  default cores/memory) sourced by `create-proxmox-resource.sh`. Add new
-  cross-script config here instead of duplicating it per-script.
+  default cores/memory, `NIX_CACHE_HOST`, `LAN_DOMAIN`) sourced by
+  `create-proxmox-resource.sh` and `scripts/installer/auto-install.sh`. Add
+  new cross-script config here instead of duplicating it per-script.
 - `scripts/bump-nixpkgs-release.sh` — bumps `flake.nix`'s `nixpkgs.url`/
   `home-manager.url` in place. Exists because flake input URLs can't
   reference `variables.nix` (confirmed empirically — `nix flake metadata`