Pulls in krebs/kartei#64 (neoprism dialable) and #65 (darwin v4 route).

kartei darwin module only dials eve/eva/ni/prism, krebs hubs that learn about
barnacle when their own registry pins move. A laptop behind NAT needs relays
we control: the same neoprism the NixOS nodes use (dialable once
krebs/kartei#64 lands) plus starkstrom.

Removed from nixpkgs in favour of better-adb-sync, which broke evaluation of
this host. Dropped rather than swapped -- nothing here used it.

starkstrom stays out of the shared kartei registry but should still be
reachable inside the fleet. Its card now lives in retiolum/ in the same
nets.<net> layout kartei and krebs.hosts use, rendered by a copy of kartei
modules/retiolum/hosts.nix, so the entry can move to kartei/lass unchanged if
the rest of krebs should reach it too.

Every superconfig machine injects that set into its tinc hosts: the NixOS
nodes through nixpkgs services.tinc, barnacle through kartei tincr module
(hosts is attrsOf lines, so the entries merge). Previously only starkstrom
itself knew its card, so the fleet had no route to it; now all 16 machines do,
and peers dial its static address directly instead of relaying.

self.retiolum exposes hosts/tincHosts/own, the same interface as kartei, so
both sources merge symmetrically. starkstrom krebs.hosts card is composed from
it -- addresses, aliases and the ed25519 key have one source now; only the
legacy RSA pubkey stockholm insists on stays local.

The daemon stays on nixpkgs services.tinc; only the host database moves.
stockholm pins a kartei from before barnacle and its host type still requires
the legacy RSA pubkey, so peer keys now come from kartei modules/retiolum/hosts.nix
instead of config.krebs.hosts. krebs.hosts is untouched for everything else
(dns, iptables, consul, ...).

Effects: barnacle and 5 newer hosts become known fleet-wide, and the 35
RSA-only entries drop out -- tincr is SPTPS-only and refused them once per
connection attempt anyway.

starkstrom has no kartei card and keeps the one it declares locally in
krebs.hosts; that fallback goes away once it is in kartei.

barnacle is the first node on kartei darwinModules.retiolum: 2configs/retiolum.nix
is built on nixpkgs services.tinc, systemd-networkd and networking.firewall,
none of which exist on nix-darwin.

Host data (addresses, aliases, peer host files) comes from lass/hosts/barnacle
in kartei; the NixOS machines still read their host data through stockholm and
will not route to barnacle until that kartei pin is bumped.

The Ed25519 keypair is a clan var like on the NixOS nodes, but deployed with
neededFor = "activation": clans /run/secrets installer is Linux-only (tmpfs +
move-mount). No RSA half, tincr is SPTPS/Ed25519-only.

The source has a full macOS backend (utun via SYSPROTO_CONTROL, recvmsg_x
batching), and 5pkgs/flake-module.nix filters on meta.availableOn, so the
linux-only platforms list kept packages.<darwin>.tincr from existing.
barnacle needs it for retiolum key generation.

location of person.lass from home-assistant on an OSM map with a 24h trail;
neoprism polls the hass history API every 2 min into a static json,
token via clan vars (where-lassul-us/token)

One radicle-node serves one keypair, so each machine that does radicle
work gets its own identity (vars generator `rad`) and a node running
as the `rad` system user over /var/lib/rad. The profile is group-shared
(setgid dirs, umask-002 wrappers for rad/git-remote-rad, pre-created
group-writable sqlite files) so any account in group `rad` signs with
the machine identity; mainUser is a member. RAD_HOME points there for
login shells. Imported explicitly on coaxmetal, neoprism, ignavia,
icarus and shodan.

Rename the public seed module to 2configs/radicle.lassul.us.nix and
switch its retired seed.radicle.garden entry to iris.radicle.network.

jitsi-videobridge's REST API already listens on 127.0.0.1:8080 on
neoprism, so radicle-httpd failed with "Address already in use" on every
restart and nginx proxied radicle.lassul.us to Jetty's 404 page.

Local clan service exporting <name>.r as a direct peer with priority 3000,
above internet/yggdrasil (2000).

matrix-nio 0.26 dropped the withOlm/python-olm arguments, breaking the
override and every nixos-yellow CI check since the last flake.lock update.

Fork carried only fix/pmtu-blackhole-recovery on a base now 167 commits
behind upstream. Upstream has since landed the principled successors
(pmtu revalidate-idle-UDP, sub-MINMTU convergence, UDPDiscoveryTimeout
floor, gossip dedup purge). tinc-crypto now links openssl-sys, so add
pkg-config + openssl.