refactor(guest): simplify guest options

guests/actualbudget.nix

@@ -39,7 +39,7 @@ in
     ];
 
     guests.actualbudget = {
-      mounts.${dataDir}.hostPath = cfg.dataPath;
+      mounts.${dataDir}.directory = cfg.dataPath;
       limits = {
         memory = lib.mkDefault "2G";
         cpu = lib.mkDefault "200%";

guests/copyparty.nix

@@ -106,19 +106,20 @@ in
     ];
 
     guests.copyparty = {
-      secrets = [ cfg.passwordSecret ];
       mounts =
         {
           ${cfg.stateDir} = {
-            hostPath = cfg.statePath;
-            create = {
-              owner = config.registry."stable-uid".${config.networking.hostName}.copyparty;
-              group = "storage";
-              mode = "0770";
-            };
+            directory = cfg.statePath;
+            owner = config.registry."stable-uid".${config.networking.hostName}.copyparty;
+            group = "storage";
+            mode = "0770";
+          };
+          ${"/run/secrets/${cfg.passwordSecret}"} = {
+            file = config.sops.secrets.${cfg.passwordSecret}.path;
+            readOnly = true;
           };
         }
-        // lib.mapAttrs' (_urlPath: volume: lib.nameValuePair volume.path { inherit (volume) hostPath; }) cfg.volumes;
+        // lib.mapAttrs' (_urlPath: volume: lib.nameValuePair volume.path { directory = volume.hostPath; }) cfg.volumes;
       limits = {
         memory = lib.mkDefault "2G";
         cpu = lib.mkDefault "200%";

guests/nesting-sample.nix

@@ -1,11 +0,0 @@
-args@{ flake, ... }:
-# A sample guest whose interior runs an OCI container on Podman.
-# The image is pulled at runtime, so the guest builds with no build-time fetch.
-flake.mkGuest {
-  name = "nesting-sample";
-  interior = {
-    virtualisation.oci-containers.containers.hello = {
-      image = "docker.io/library/hello-world";
-    };
-  };
-} args

guests/sample.nix

@@ -1,5 +0,0 @@
-args@{ flake, ... }:
-# The tracer-bullet guest: the thinnest complete path from discovery to a
-# running nested container. Its interior is just the guest-base — the baseline
-# toolset and SSH access — so it proves the concept without carrying a service.
-flake.mkGuest { name = "sample"; } args