ci.yml calls farm.yml (now reusable) instead of the eval-only nixos-*
checks, which are gone from flake.nix. The farm job is only the
coordinator (scheduler + envoy, which now requires the farm client
cert, reachable over iroh). Each machine job joins as a builder,
evaluates its machine, builds the toplevel through the farm and leaves
when done; its outputs are in niks3 by then.

ci runs for master pushes, PRs and dispatches; a newer run for the same
ref cancels the older one, farms of different refs queue FIFO
(queue: max). update-pkgs verifies PRs with ci.yml alone.

The crit wrapper writes a fresh random 10-char id per daemon port into
/var/lib/crit-routes; a path unit turns that into an nginx map on
coaxmetal:7720 (retiolum only). neoprism proxies *.review.lassul.us there
with a wildcard cert obtained via DNS-01 (RFC2136) against a delegated
_acme-challenge.review.lassul.us zone on knot, so ids never hit CT logs.

acheron gets a minimal system-wide pipewire with a virtual "hub" sink.
Any LAN machine sends into it via ROC while `gg23-audio` from
tools/gg23-audio runs (ROC sink loaded into pipewire-pulse, removed again
on Ctrl-C), barnacle via AirPlay 1 (shairport-sync, "gg23", pipewire
backend, mDNS on int0 only).
The hub monitor is linked to ROC sinks for shodan and icarus (room.nix),
chosen with `audio-room shodan|icarus|both|off` or from Home Assistant via
MQTT discovery (select + buttons). Retained MQTT commands restore the choice
after pipewire restarts.

The rooms have no stable LAN address, so the hub sends to their retiolum IPs
and they accept the ROC ports only from acheron on retiolum.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>