feat(neogaia): declare a 2 GiB EFI system partition (task 0016)

Each generation stores a kernel and an initrd on the EFI system partition,
and this host runs a large third-party kernel, so 512 MiB holds only about
seven. An exhausted partition fails at bootloader installation, after the
build has already succeeded.

The partition cannot grow in place: it sits first on the disk with the
encrypted container immediately behind it, and an encrypted volume's start
offset cannot move without rewriting its whole payload. Only an install
applies this layout, so the change takes effect at the next reimage and
does nothing to the running machine until then.

Record that a flake only sees git-tracked files, which cost an evaluation
earlier, and correct the git identity gotcha that a hand-written gitconfig
had made false.

.claude/tasks/0016-esp-resize-and-reimage.md

@@ -20,10 +20,42 @@ One thing must be true before the disk is erased: every branch worth keeping has
 
 ## Acceptance criteria
 
-- [ ] The `Host`'s disk layout declares a 2 GiB EFI system partition
-- [ ] Every local branch worth keeping exists on the remote before the disk is erased
+- [x] The `Host`'s disk layout declares a 2 GiB EFI system partition
+- [x] Every local branch worth keeping exists on the remote before the disk is erased
 - [ ] The reimage is performed from a configuration carrying the hardware profile, following the existing install documentation
 - [ ] The install documentation is corrected wherever the procedure diverged from what it describes
 - [ ] Manual confirmation: the machine boots, the encrypted root unlocks, and console login succeeds
 - [ ] Manual confirmation: reported free space on the boot partition is consistent with its 2 GiB size, resolving the discrepancy observed before the reimage — where a 512 MiB partition reported 1022 MiB
-- [ ] The project's agent instructions record that a flake only sees git-tracked files, so an untracked file is invisible to evaluation
+- [x] The project's agent instructions record that a flake only sees git-tracked files, so an untracked file is invisible to evaluation
+
+## Implementation Notes
+
+This task is **blocked on an operator action**, not finished. Three of seven
+criteria are satisfied: the declaration, the branch check, and the recorded
+gotcha. The remaining four all depend on erasing the disk, which is not an
+action taken on the operator's behalf.
+
+The branch check was verified rather than assumed — no local branch holds a
+commit absent from the remote, so nothing is lost to the wipe. Two items that
+live outside the repo do not survive it and are not covered by any criterion:
+the agent memory directory, and the wifi credentials.
+
+Criterion 4 is deliberately left open despite four corrections already landing
+on the main branch — a wrong repository name in both clone commands, a closing
+section describing a superseded key-derivation design, a stale enumeration of
+flake inputs, and a bootstrap-ordering sentence contradicting a later one. All
+four were found by reading the procedure. The criterion asks for divergences
+found by *running* it, which has not happened. The wrong repository name would
+have stopped the install at the clone step, so the reading pass was worth doing;
+it is just not the same evidence.
+
+**Ordering hazard.** Between merging this and completing the reimage, the
+repository asserts a partition layout the physical disk does not have, and disko
+reconciles nothing on a running machine. The declaration should reach the branch
+the install reads immediately before the install, not days ahead of it. If the
+reimage is deferred, this is the file that quietly lies about the only laptop.
+
+One correction outside this task's scope also landed here: the gotcha claiming
+git identity was unconfigured, which a hand-written `~/.gitconfig` had made
+false. Moving that identity into the flake belongs to the commit-identity work
+this task's description explicitly fences off.

CLAUDE.md

@@ -29,9 +29,12 @@ The domain model (Host, Module, Skeleton, Auto-loader, Enable convention, overla
   Both were true only while the machine still ran CachyOS against a distro Nix daemon.
 - The substituters a `nix build` fetches from are the **daemon's** (`/etc/nix/nix.conf`), *not* the `nix.settings` of the config being built — those only govern the built system.
   The two coincide here because the dev host runs this flake; they diverge on any machine that does not.
-- Git identity is not configured anywhere yet — no `programs.git` in the flake and no `~/.gitconfig`, so `git commit` fails with "Author identity unknown".
-  History uses `alexion <contact@alexion.dev>`; pass it per-commit with `git -c user.name=… -c user.email=…` rather than writing config outside the flake.
+- Git identity is not declared in the flake — there is no `programs.git` — but commits do work: identity comes from a hand-written `~/.gitconfig` plus this checkout's `.git/config`.
+  Both sit outside the flake, so neither survives a reimage nor reaches another machine; history uses `alexion <contact@alexion.dev>`.
 - The primary build/verify seam for any Host is `nix flake check`, which builds `checks.x86_64-linux.<host>` (the system toplevel); cheap targeted checks use `nix eval .#nixosConfigurations.<host>.config...`.
+- A flake only sees **git-tracked** files, so a new file that has not been `git add`ed is invisible to evaluation even though it exists on disk.
+  The failure names the path and reads as if the file were missing: `error: Path 'secrets/shared.yaml' does not exist in Git repository`.
+  Staging is enough; the file need not be committed.
 - chaotic-nyx must **not** follow our `nixpkgs`, and its packages are built against chaotic's own pinned nixpkgs (its overlay defaults to `onTopOf = "flake-nixpkgs"`, the cache-friendly path).
   That is what lets the `nyx-cache.chaotic.cx` binary cache hit instead of compiling the CachyOS kernel from source; the tradeoff is that chaotic packages do not see our `unstable`/`stable` overlays.
 - The remote is self-hosted Gitea (`git.alexion.dev`), and the intended CLI is `gitea-axi` rather than `tea`.

hosts/neogaia/disk.nix

@@ -10,7 +10,9 @@
       type = "gpt";
       partitions = {
         ESP = {
-          size = "512M";
+          # Each generation stores a kernel and initrd here and the CachyOS
+          # kernel is large; an exhausted partition fails bootloader installs.
+          size = "2G";
           type = "EF00";
           content = {
             type = "filesystem";