ci: drop darwin shims, rebuild locally on netty runner

- remove macOS-era `sudo mkdir /Users/rathi/...` shim steps from flake-check
  and nix-format (Linux runner, paths don't exist, gitea-runner has no sudo)
- deploy-netty now runs `sudo nixos-rebuild switch --flake .#netty` directly
  on the runner (it *is* netty), no SSH, no `just switch-netty`
- grant gitea-runner NOPASSWD sudo for nixos-rebuild only
- apply current nixfmt to home/scripts.nix, hermes-gateway.nix, devshells.nix

Made-with: Cursor

hosts/netty/forgejo-runner.nix

@@ -8,6 +8,21 @@ let
   cacheRoot = "/var/cache/forgejo-runner";
 in
 {
+  security.sudo.extraRules = [
+    {
+      users = [ "gitea-runner" ];
+      commands = [
+        {
+          command = "/run/current-system/sw/bin/nixos-rebuild";
+          options = [
+            "NOPASSWD"
+            "SETENV"
+          ];
+        }
+      ];
+    }
+  ];
+
   systemd.tmpfiles.rules = [
     "d ${cacheRoot} 0750 gitea-runner gitea-runner -"
     "d ${cacheRoot}/cargo 0750 gitea-runner gitea-runner -"