refactor(nixos): scope agent guidance

src/skills/style/nix/rules/dotfiles.md

@@ -0,0 +1,42 @@
+## Register desktop window icons
+
+### Rule
+
+Register each graphical desktop application in `registry.window-icon`.
+Match the entry to the window class.
+Store the icon as its rendered string.
+
+### Rationale
+
+The Hyprland workspace indicator uses the registry to replace its default glyph.
+
+### Examples
+
+List active window classes with:
+
+```bash
+hyprctl clients -j | jq -r '.[].class' | sort -u
+```
+
+## Separate guest wiring from deployment configuration
+
+### Rule
+
+Keep guest modules host agnostic.
+Put host paths, served volumes, guest addresses, and routes in host configuration.
+
+### Rationale
+
+A guest module supports multiple hosts.
+Host configuration owns each deployment's infrastructure choices.
+
+## Decrypt guest secrets on the host
+
+### Rule
+
+Set the owner of a host-decrypted guest secret to a host user.
+Grant guest services access with a shared group and a read-only guest mount.
+
+### Rationale
+
+SOPS decrypts the secret on the host before the guest receives its bind mount.

src/skills/style/nix/rules/general.md

@@ -22,6 +22,18 @@ Do not call `lib.removeSuffix ".nix"` outside the utility definition.
 
 The utility centralizes Nix file-name normalization.
 
+## Qualify library functions
+
+### Rule
+
+Call library functions as `lib.<function>`.
+Do not import individual functions with `inherit (lib)`.
+
+### Rationale
+
+Qualification makes library ownership explicit.
+It prevents local namespace collisions.
+
 ## Use executable helpers for package commands
 
 ### Rule