Fix formatting in pxe-boot host.nix

- Document bidirectional LAN ↔ Tailscale routing via tailscale-router
  (static route on router for 100.64.0.0/10, subnet advertisement into Tailnet)
- Document DNS proxy chain: FreeIPA conditional forwarder for *.ts.net
  → tailscale-router → MagicDNS; reverse for *.sweet.home from Tailscale clients
- Remove stale pihole.sweet.home from IP table (decommissioned)
- Fix freeipa role: remove Pi-hole IP from ipa_dns_forwarder, document
  ts.net conditional forwarder as a post-install step
- Fix inventory: remove Pi-hole forwarder IP, add ts.net forwarder note

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP

hosts/pxe-boot/host.nix

@@ -11,9 +11,7 @@
     defaultGateway = { address = vars.lanGateway; interface = vars.lxcLanInterface; };
     nameservers = [ vars.domainControllerIp ];
   };
-services.beszel.agent.environment = {
-#    KEY = "";
-  };
+  services.beszel.agent.environment = { };
   # Preserved from the pre-refactor `pxe-boot` target — stateVersion must
   # never be bumped on an already-installed machine.
   system.stateVersion = "25.05";

scripts/codex-maintenance.sh

@@ -37,6 +37,17 @@ source "${script_dir}/lib/nix-parallel.sh"
 repo_root="$(cd "${script_dir}/.." && pwd)"
 cd "$repo_root"
 
+# When this repo is a subdirectory of a larger git repo (e.g. a mono-repo
+# subtree), `git diff --name-only` outputs paths relative to the outer git
+# root, not this directory. Compute a prefix to strip so pattern matching
+# below works correctly regardless of nesting depth.
+_git_root="$(git rev-parse --show-toplevel 2>/dev/null || echo "$repo_root")"
+if [[ "$repo_root" != "$_git_root" ]]; then
+  _subtree_prefix="${repo_root#"$_git_root"/}/"
+else
+  _subtree_prefix=""
+fi
+
 full_check=false
 dry_run=false
 
@@ -120,7 +131,7 @@ if ! $full_check; then
   base_ref="$(resolve_base_ref)"
   echo
   echo "Changed-files scope: diffing against ${base_ref}"
-  mapfile -t changed_files < <(git diff --name-only --diff-filter=ACMR "$base_ref" -- . | sort -u)
+  mapfile -t changed_files < <(git diff --name-only --diff-filter=ACMR "$base_ref" -- . | sort -u | sed "s|^${_subtree_prefix}||")
 
   if [[ ${#changed_files[@]} -eq 0 ]]; then
     echo "No changed files detected."