refactor(nixos): scope agent guidance

src/skills/style/nix/rules/dotfiles.md

@@ -0,0 +1,43 @@
+## Register window icons
+
+### Rule
+
+Each graphical application has a `registry.window-icon` entry with a window-class match and rendered icon.
+
+### Rationale
+
+Hyprland uses this registry to render workspace icons for open application windows.
+
+Run this command to list window classes from the running compositor:
+
+```bash
+hyprctl clients -j | jq -r '.[].class' | sort -u
+```
+
+## Separate guest wrappers from service modules
+
+### Rule
+
+Each guest module wraps one service module.
+The guest enables its service through `guests.<name>.interior`.
+Service modules own service configuration.
+Guest modules configure bind mounts, secret delivery, resource limits, and registry entries.
+Host configuration supplies deployment-specific paths, volumes, addresses, and routes.
+
+### Rationale
+
+Service modules support a service without guest infrastructure.
+Guest modules adapt a service module to a guest.
+Host configuration provides deployment-specific values.
+
+## Decrypt guest secrets on the host
+
+### Rule
+
+A host user owns each guest secret before SOPS decrypts it.
+Each guest service group accesses its secrets through a read-only bind mount.
+
+### Rationale
+
+Guest service accounts do not exist on the host, where SOPS creates secrets.
+The shared service group preserves read access across the guest boundary.