- remove macOS-era `sudo mkdir /Users/rathi/...` shim steps from flake-check
and nix-format (Linux runner, paths don't exist, gitea-runner has no sudo)
- deploy-netty now runs `sudo nixos-rebuild switch --flake .#netty` directly
on the runner (it *is* netty), no SSH, no `just switch-netty`
- grant gitea-runner NOPASSWD sudo for nixos-rebuild only
- apply current nixfmt to home/scripts.nix, hermes-gateway.nix, devshells.nix
Made-with: Cursor
- switch all jobs to runs-on: native so the netty forgejo runner picks them up
- deploy-netty now runs locally on netty via `just switch-netty` (no SSH)
- fix tmpfiles owner: gitea-actions-runner creates user `gitea-runner`, not `forgejo-runner`
Made-with: Cursor
