fix(nixos): deploy from source checkout

configs/nixos/AGENTS.md

@@ -50,7 +50,10 @@
   directories already exist inside the read-only source.
   For aggregate Copyparty volumes such as `/srv` with nested `/srv/inbox`, keep the guest bind mount
   writable and enforce read-only behavior through Copyparty access plus service `ReadWritePaths`.
-- Pikachu deploys from the monorepo checkout copied to `~/dev`.
-  Do not use the old `~/wrk/dotfiles` path for remote rebuild commands.
+- `deploy-to` builds from the source checkout and activates an imported closure on the target.
+  Do not rely on a target-local monorepo checkout for remote deployment.
+- On Pikachu, `nix copy --to ssh://pikachu` accepted a small `nix store add-file` probe,
+  but rejected locally built system paths that lacked trusted signatures.
+  Use a sudo `nix-store --import` path for unsigned deploy closures.
 - Do not hand-author `hardware-configuration.nix` for a host that has not been generated on that machine.
   Generate it on the target system or live ISO, then stage it before evaluating the flake.