Pulls in krebs/kartei#64 (neoprism dialable) and #65 (darwin v4 route).

kartei darwin module only dials eve/eva/ni/prism, krebs hubs that learn about
barnacle when their own registry pins move. A laptop behind NAT needs relays
we control: the same neoprism the NixOS nodes use (dialable once
krebs/kartei#64 lands) plus starkstrom.

Removed from nixpkgs in favour of better-adb-sync, which broke evaluation of
this host. Dropped rather than swapped -- nothing here used it.

starkstrom stays out of the shared kartei registry but should still be
reachable inside the fleet. Its card now lives in retiolum/ in the same
nets.<net> layout kartei and krebs.hosts use, rendered by a copy of kartei
modules/retiolum/hosts.nix, so the entry can move to kartei/lass unchanged if
the rest of krebs should reach it too.

Every superconfig machine injects that set into its tinc hosts: the NixOS
nodes through nixpkgs services.tinc, barnacle through kartei tincr module
(hosts is attrsOf lines, so the entries merge). Previously only starkstrom
itself knew its card, so the fleet had no route to it; now all 16 machines do,
and peers dial its static address directly instead of relaying.

self.retiolum exposes hosts/tincHosts/own, the same interface as kartei, so
both sources merge symmetrically. starkstrom krebs.hosts card is composed from
it -- addresses, aliases and the ed25519 key have one source now; only the
legacy RSA pubkey stockholm insists on stays local.

The daemon stays on nixpkgs services.tinc; only the host database moves.
stockholm pins a kartei from before barnacle and its host type still requires
the legacy RSA pubkey, so peer keys now come from kartei modules/retiolum/hosts.nix
instead of config.krebs.hosts. krebs.hosts is untouched for everything else
(dns, iptables, consul, ...).

Effects: barnacle and 5 newer hosts become known fleet-wide, and the 35
RSA-only entries drop out -- tincr is SPTPS-only and refused them once per
connection attempt anyway.

starkstrom has no kartei card and keeps the one it declares locally in
krebs.hosts; that fallback goes away once it is in kartei.

barnacle is the first node on kartei darwinModules.retiolum: 2configs/retiolum.nix
is built on nixpkgs services.tinc, systemd-networkd and networking.firewall,
none of which exist on nix-darwin.

Host data (addresses, aliases, peer host files) comes from lass/hosts/barnacle
in kartei; the NixOS machines still read their host data through stockholm and
will not route to barnacle until that kartei pin is bumped.

The Ed25519 keypair is a clan var like on the NixOS nodes, but deployed with
neededFor = "activation": clans /run/secrets installer is Linux-only (tmpfs +
move-mount). No RSA half, tincr is SPTPS/Ed25519-only.

The source has a full macOS backend (utun via SYSPROTO_CONTROL, recvmsg_x
batching), and 5pkgs/flake-module.nix filters on meta.availableOn, so the
linux-only platforms list kept packages.<darwin>.tincr from existing.
barnacle needs it for retiolum key generation.