Merge feat/remote-builders into uconsole-cm5-incremental

Bidirectional remote building + rename uconsole-cm5 -> uConsole:
- Rename all uconsole-cm5 refs to uConsole (nixosSystem key, paths, module)
- Replace single-machine remote-builder module with multi-machine config
- Enable remote builder on lazyworkhorse -> uConsole (aarch64)
- Enable remote builder on uConsole -> lazyworkhorse (x86_64)
- Add builder system user + SSH key via agenix-rekey (secrets/builder_key.age)
- Add builder_key + gortium_password age secrets to all hosts
- Fix pre-existing bugs: missing modules in lazyworkhorse/cyt-pi,
  SSH config structure (hostKeys outside settings), cyt-pi inline user
- Remove obsolete openclaw-node service + module + age secrets

hosts/cyt-pi/configuration.nix

@@ -21,14 +21,7 @@
     settings.PermitRootLogin = "prohibit-password";
   };
 
-  # User
-  users.users.gortium = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" "networkmanager" "kismet" ];
-    openssh.authorizedKeys.keys = [
-      # Populate with your public key
-    ];
-  };
+  # User (defined in users/gortium/gortium.nix)
 
   # CYT Project Dependencies (Headless)
   environment.systemPackages = with pkgs; [
@@ -77,6 +70,12 @@
     };
   };
 
+
+  # Age secrets
+  age.secrets.gortium_password = {
+    file = ../../secrets/gortium_password.age;
+  };
+
   # CYT Application Service
   systemd.services.cyt-app = {
     description = "Chasing Your Tail - Target Detector";

hosts/lazyworkhorse/configuration.nix

@@ -11,6 +11,10 @@
   # Flakesss
   nix.settings.experimental-features = [ "nix-command" "flakes" "flake-self-attrs" "ca-derivations" ];
   nix.settings.trusted-users = [ "root" "gortium" ];
+  nix.settings.extra-platforms = [ "aarch64-linux" ];
+
+  # QEMU binfmt for cross-building aarch64 NixOS targets
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
 
   # Garbage collection
   nix.gc = {
@@ -166,9 +170,8 @@
     settings = {
       PasswordAuthentication = false;
       KbdInteractiveAuthentication = false;
-  # ============================================================
-  # ClamAV antivirus — daemon, hourly updates, daily scan, on-access
-  # ============================================================
+    };
+    hostKeys = [
       {
         path = "/etc/ssh/ssh_host_ed25519_key";
         type = "ed25519";
@@ -271,13 +274,6 @@
         mode = "0600";
         path = "/home/ai-worker/.ssh/ai_ssh_key";
       };
-      openclaw_gateway_token = {
-        file = ../../secrets/openclaw_gateway_token.age;
-        owner = "root";
-        group = "ai-worker";
-        mode = "0440";
-        path = "/run/secrets/openclaw_gateway_token";
-      };
       wireguard_private_key = {
         file = ../../secrets/wireguard_private_key.age;
         owner = "root";
@@ -291,20 +287,24 @@
         group = "root";
         mode = "0400";
         path = "/run/secrets/wireguard_preshared_key";
+      };
+            builder_key = {
+        file = ../../secrets/builder_key.age;
+        owner = "root";
+        group = "root";
+        mode = "0600";
+        path = "/etc/ssh/builder_key";
+      };
+      gortium_password = {
+        file = ../../secrets/gortium_password.age;
+        owner = "gortium";
+        group = "gortium";
+        mode = "0400";
+        path = "/run/secrets/gortium_password";
       };
     };
   };
 
-  # OpenClaw Node service (host-side execution for Docker gateway)
-  services.openclaw-node = {
-    enable = true;
-    user = "ai-worker";
-    gatewayHost = "127.0.0.1";
-    gatewayPort = 18789;
-    gatewayTokenFile = "/run/secrets/openclaw_gateway_token";
-    displayName = "lazyworkhorse-host";
-  };
-
   # Public host ssh key (kept in sync with the private one)
   environment.etc."ssh/ssh_host_ed25519_key.pub".text =
     "${keys.hosts.lazyworkhorse.main}";
@@ -567,21 +567,22 @@
   # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
   system.stateVersion = "25.05"; # Did you read the comment?
 
+
+  # ============================================================
+  # Remote builder — dispatches aarch64-linux builds to uConsole
+  # ============================================================
+  services.remoteBuilder = {
+    enable = true;
+    machines = [
+      {
+        hostName = "192.168.1.120";
+        port = 22;
+        sshUser = "builder";
+        sshKey = config.age.secrets.builder_key.path;
+        systems = [ "aarch64-linux" ];
+        maxJobs = 4;
+      }
+    ];
+  };
+
 }
-
-  # Remote builder — uConsole for aarch64-linux native builds
-  nix.distributedBuilds = true;
-  nix.buildMachines = [{
-    hostName = "192.168.1.120";
-    systems = ["aarch64-linux"];
-    maxJobs = 4;
-    supportedFeatures = ["big-parallel" "nixos-test" "benchmark" "gccarch-armv8-a"];
-    sshUser = "builder";
-    sshKey = "/home/ai-worker/id_deploy";
-  }];
-  nix.extraOptions = '
-    builders-use-substitutes = true
-    fallback = true
-  ';
-
-

hosts/uConsole/configuration.nix

@@ -191,6 +191,28 @@
   # ============================================================
   networking.firewall.allowedTCPPorts = [ 22 ];
   networking.firewall.allowedUDPPorts = [ ];
+  # ============================================================
+  # Remote builder — dispatches x86_64-linux builds to lazyworkhorse
+  # ============================================================
+  services.remoteBuilder = {
+    enable = true;
+    machines = [
+      {
+        hostName = "lazyworkhorse.net";
+        port = 2424;
+        sshUser = "builder";
+        sshKey = config.age.secrets.builder_key.path;
+        systems = [ "x86_64-linux" ];
+        maxJobs = 36;
+        supportedFeatures = [ "benchmark" "big-parallel" "nixos-test" ];
+      }
+    ];
+  };
+  # Age secret for builder SSH key (remote building)
+  age.secrets.builder_key = {
+    file = ../../secrets/builder_key.age;
+  };
+
   # ============================================================
   # agenix-rekey — automatic secret re-encryption at deploy time
   # ============================================================