feat(neogaia): declare the encrypted disk with disko

Add disko as a flake input (following nixpkgs) and wire its NixOS module
into the host-builder, so any Host can declare a disk layout while the
layout itself stays a per-Host concern.

neogaia's layout (hosts/neogaia/disk.nix): one GPT NVMe disk with a
systemd-boot EFI system partition and a LUKS container holding btrfs with
@root/@home/@nix subvolumes. The initrd prompts for the passphrase on a
normal boot. Swap is RAM-backed zram, so there is no on-disk swap
partition; zramSwap is enabled directly for now. The placeholder
fileSystems are removed since disko now derives them.

hosts/neogaia/default.nix

@@ -1,23 +1,23 @@
 { ... }:
 # neogaia — Dell XPS 13 9380 laptop.
 #
-# The filesystems and hardware profile below are placeholder values, not the
-# machine's real encrypted layout.
+# The disk layout lives in ./disk.nix (disko); the resulting `fileSystems` are
+# derived from it, so none are declared by hand here.
 {
-  imports = [ ./hardware-configuration.nix ];
+  imports = [
+    ./hardware-configuration.nix
+    ./disk.nix
+  ];
 
   system.stateVersion = "26.05";
 
+  # systemd-boot on the EFI system partition disko creates. The initrd prompts
+  # for the LUKS passphrase (disko wires up boot.initrd.luks.devices), so a
+  # normal boot unlocks the encrypted root.
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
-  # Placeholder label-based filesystems.
-  fileSystems."/" = {
-    device = "/dev/disk/by-label/nixos";
-    fsType = "ext4";
-  };
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-label/BOOT";
-    fsType = "vfat";
-  };
+  # Swap is RAM-backed zram rather than an on-disk partition. Task 0003 lifts
+  # this into the zram toggle Module; enabled directly here for now.
+  zramSwap.enable = true;
 }

hosts/neogaia/disk.nix

@@ -0,0 +1,66 @@
+{ ... }:
+# neogaia's disk layout, declared with disko and interpreted by the disko module
+# the host-builder wires in. This is a per-Host concern: another Host declares a
+# different `disko.devices` (or none, preserving an existing pool by importing it).
+#
+# One NVMe disk, GPT: an EFI system partition for systemd-boot, and a LUKS
+# container holding a btrfs filesystem with subvolumes. Swap is zram (RAM-backed),
+# so there is deliberately no on-disk swap partition. disko derives the matching
+# `fileSystems.*` and `boot.initrd.luks.devices.*` from this, so a normal boot
+# prompts for the passphrase in the initrd and unlocks the encrypted root.
+{
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/nvme0n1";
+    content = {
+      type = "gpt";
+      partitions = {
+        ESP = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [ "umask=0077" ];
+          };
+        };
+        luks = {
+          size = "100%";
+          content = {
+            type = "luks";
+            name = "cryptroot";
+            settings.allowDiscards = true;
+            content = {
+              type = "btrfs";
+              extraArgs = [ "-f" ];
+              subvolumes = {
+                "@root" = {
+                  mountpoint = "/";
+                  mountOptions = [
+                    "compress=zstd"
+                    "noatime"
+                  ];
+                };
+                "@home" = {
+                  mountpoint = "/home";
+                  mountOptions = [
+                    "compress=zstd"
+                    "noatime"
+                  ];
+                };
+                "@nix" = {
+                  mountpoint = "/nix";
+                  mountOptions = [
+                    "compress=zstd"
+                    "noatime"
+                  ];
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}