fix(neogaia): replace guessed hardware detection with a real scan (task 0017)

The detection file was written before the machine ran NixOS, as an educated
guess at what a Dell XPS 13 9380 needs, and said so. Its contents now come
from nixos-generate-config on the running machine.

The guess was wider than the measurement rather than narrower: it named
thunderbolt, usb_storage and sd_mod, none of which the scan reports, and
omitted rtsx_pci_sdmmc. Nothing needed to reach the root device was missing.

Filesystem, swap, LUKS and microcode declarations from the scan are dropped.
The disk layout derives the first three and the hardware profile supplies the
last, so carrying them here would duplicate definitions that are produced on
every evaluation.

.claude/tasks/0017-hardware-detection-refresh.md

@@ -14,7 +14,27 @@ Generating the scan requires root on the target machine.
 
 ## Acceptance criteria
 
-- [ ] The detection file's contents come from a scan of the running machine rather than a guess
-- [ ] Filesystem and swap declarations are absent from it, leaving the disk layout as the sole source of those
-- [ ] The file no longer describes itself as a placeholder, and says plainly what it holds
-- [ ] `nix flake check` builds the `neogaia` toplevel
+- [x] The detection file's contents come from a scan of the running machine rather than a guess
+- [x] Filesystem and swap declarations are absent from it, leaving the disk layout as the sole source of those
+- [x] The file no longer describes itself as a placeholder, and says plainly what it holds
+- [x] `nix flake check` builds the `neogaia` toplevel
+
+## Implementation Notes
+
+**The guess was wider than the measurement, not narrower.**
+It named `thunderbolt`, `usb_storage`, and `sd_mod`, none of which the scan reports; the scan adds `rtsx_pci_sdmmc` for the card reader.
+Nothing needed to reach the root device was missing, so the guess was adequate as the task assumed, but it was not accurate.
+`sd_mod` survives in the resolved list regardless, supplied by nixpkgs' own defaults; `thunderbolt` and `usb_storage` now genuinely go, and they matter only for booting from external media, which this machine does not do.
+
+**Two further lines from the scan were dropped beyond the filesystem and swap declarations the task named.**
+`boot.initrd.luks.devices."cryptroot".device` is derived by the disk layout, which the layout file already states, so keeping it would have created the same duplicate definition the task drops the filesystems to avoid.
+`hardware.cpu.intel.updateMicrocode` falls outside the three things the task keeps, and the hardware profile supplies it anyway.
+Both were checked rather than assumed: after the change the LUKS device, all four filesystems, and microcode all still resolve.
+
+**The header was rewritten twice.**
+Its first form enumerated the file's three attributes, which the repo's comment convention names as a feature inventory and forbids in a file-top header.
+It now carries provenance and the absence pointer only.
+
+**Not verified by a boot.**
+`nix flake check` proves the configuration evaluates and builds, not that the initrd it produces can unlock LUKS and mount root.
+Only a rebuild and reboot establishes that, with the previous generation available at the bootloader as the fallback.