The hourly GitHub Actions cron mirroring from Tangled fails regularly.
Switch to a Tangled spindle workflow that pushes to GitHub on each push
to main. Requires GITHUB_TOKEN secret configured in Tangled repo settings.

The default GITHUB_TOKEN lacks the workflows scope, so mirror pushes
that touch .github/workflows/ are rejected. Swap to a fine-grained
PAT (MIRROR_TOKEN) with Contents + Workflows write.

Catches up with all the shared-modules work from this session:
- darwinModules.{nix-homebrew-base,fish-unstable}
- homeManagerModules.git-sops-signing
- (other infra.* modules used by NixOS hosts in nix-config, unused here)
- dead code removal (modules/nixos/files.nix, polybar comments)

Drv for darwinConfigurations.work is byte-identical to the prior
locked state (verified via nix eval).

- nix-darwin.nix: empty `{ ... }:` -> `_:` in the inline nix-homebrew
config module.
- macbook.nix: `{ nixpkgs-unstable = inputs.nixpkgs-unstable; }` ->
`{ inherit (inputs) nixpkgs-unstable; }` for the fish-unstable call.

Drv is byte-identical (verified pre/post).

Mirror the plessur layout: extract overlays, nix-settings, fonts, and
user/home-manager wiring into separate files. macbook.nix becomes a
thin composition module.

environment.systemPackages stays in macbook.nix so its merge order vs
the darwin modules' contributions is preserved — drv is byte-identical
to baseline.

- home.nix: take userEmail from config.infra.emails.work instead of
the literal "ivan.ilak@mxwbio.com". The infra.emails.work option
already existed in nix-modules; nothing else changed.
- additional_config_parameters.nix: use rec self-references to drive
homeDir from infra.host.user, and sshAuthSock from infra.host.homeDir.

Drv for darwinConfigurations.work is byte-identical to baseline.

Replace three inline modules with the new shared modules from
nix-modules:

- nix-homebrew wiring -> darwinModules.nix-homebrew-base
- git+sops signing block -> homeManagerModules.git-sops-signing
- fish overlay -> darwinModules.fish-unstable

Drv-path for darwinConfigurations.work is unchanged.

Requires nix-modules at 0407b28 or later.

Add basic CI on main:
- flake-check.yml: runs `nix flake check --all-systems`
- lint.yml: runs `statix check` and `deadnix --fail`

Remove `flakeRoot = inputs.self;` from nix-darwin.nix and stop passing
`flakeRoot = inputs.nix-modules` to shared_packages.nix, which now
uses relative imports internally.