heather: switch to make-disk-image (qcow2 for YC), drop disko

- Rename muscari -> heather (YC VM). rosemary reserved for future EU server.
- Add hosts/heather/image.nix: YC guest profile + qcow2 build target based on
  nixos/lib/make-disk-image.nix (the nixpkgs-standard cloud image builder).
  partitionTableType=legacy (MBR + single ext4 root, label nixos), GRUB in MBR
  on /dev/vda, virtio drivers, console=ttyS0, cloud-init (Ec2 datasource) so
  poppy ssh key auto-lands from YC metadata, growPartition.
- Drop disko flake input + disk-config.nix (was only for nixos-anywhere runtime
  install; replaced by make-disk-image build-time approach, no kexec).
- Add home/server.nix: minimal headless home for NixOS hosts (no ollama/
  texliveFull/kitty/syncthing/pass). flake mkNixos uses it instead of full ./home.
- k3s.nix: drop dead firewall block (firewall off in image.nix -> trustedInterfaces
  was a no-op). Cilium manages pod networking via BPF.
- image.baseName=heather, configurationLimit=1, remove virtio dups (qemu-guest
  profile already provides most).
- Fix sha256 pin on forgejo mikl.keys (was stale, would break fetchurl).
- home/zsh.nix: source yandex-cloud yc completion.

flake.lock

@@ -1,25 +1,5 @@
 {
   "nodes": {
-    "disko": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1781152676,
-        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
-        "owner": "nix-community",
-        "repo": "disko",
-        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "disko",
-        "type": "github"
-      }
-    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -78,7 +58,6 @@
     },
     "root": {
       "inputs": {
-        "disko": "disko",
         "home-manager": "home-manager",
         "nix-darwin": "nix-darwin",
         "nixpkgs": "nixpkgs",