fix(nixos): defer zeus hardware detection

configs/nixos/AGENTS.md

@@ -46,3 +46,5 @@
   Use a host-visible owner plus a shared group mode when the guest service can read the decrypted secret file through its group.
 - Pikachu deploys from the monorepo checkout copied to `~/dev`.
   Do not use the old `~/wrk/dotfiles` path for remote rebuild commands.
+- Do not hand-author `hardware-configuration.nix` for a host that has not been generated on that machine.
+  Generate it on the target system or live ISO, then stage it before evaluating the flake.