feat: bidirectional remote builders — server <> uConsole

Add reusable remote-builder NixOS module and builder system user.

Server (lazyworkhorse): dispatches aarch64-linux builds to uConsole
uConsole: dispatches x86_64-linux builds to server

The builder user uses the same SSH keypair on both hosts for
symmetric remote building. Generate the key with:
  ssh-keygen -t ed25519 -f /etc/ssh/builder_key -N ""
Add the public key to lib/keys.nix (replace PLACEHOLDER).

hosts/lazyworkhorse/configuration.nix

@@ -573,5 +573,23 @@
   # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
   system.stateVersion = "25.05"; # Did you read the comment?
 
+
+  # ============================================================
+  # Remote builder — dispatches aarch64-linux builds to uConsole
+  # ============================================================
+  services.remoteBuilder = {
+    enable = true;
+    machines = [
+      {
+        hostName = "192.168.1.120";
+        port = 22;
+        sshUser = "builder";
+        sshKey = "/etc/ssh/builder_key";
+        systems = [ "aarch64-linux" ];
+        maxJobs = 4;
+      }
+    ];
+  };
+
 }
 

hosts/uConsole/configuration.nix

@@ -168,4 +168,23 @@
   # Reticulum uses its own encryption and doesn't need open ports
   # for basic mesh operations (peer-to-peer discovery).
   # For TCP interfaces, open additional ports as needed.
+
+  # ============================================================
+  # Remote builder — dispatches x86_64-linux builds to server
+  # ============================================================
+  services.remoteBuilder = {
+    enable = true;
+    machines = [
+      {
+        hostName = "lazyworkhorse.net";
+        port = 2424;
+        sshUser = "builder";
+        sshKey = "/etc/ssh/builder_key";
+        systems = [ "x86_64-linux" ];
+        maxJobs = 36;
+        supportedFeatures = [ "benchmark" "big-parallel" "nixos-test" ];
+      }
+    ];
+  };
+
 }