heather: switch to make-disk-image (qcow2 for YC), drop disko

- Rename muscari -> heather (YC VM). rosemary reserved for future EU server.
- Add hosts/heather/image.nix: YC guest profile + qcow2 build target based on
  nixos/lib/make-disk-image.nix (the nixpkgs-standard cloud image builder).
  partitionTableType=legacy (MBR + single ext4 root, label nixos), GRUB in MBR
  on /dev/vda, virtio drivers, console=ttyS0, cloud-init (Ec2 datasource) so
  poppy ssh key auto-lands from YC metadata, growPartition.
- Drop disko flake input + disk-config.nix (was only for nixos-anywhere runtime
  install; replaced by make-disk-image build-time approach, no kexec).
- Add home/server.nix: minimal headless home for NixOS hosts (no ollama/
  texliveFull/kitty/syncthing/pass). flake mkNixos uses it instead of full ./home.
- k3s.nix: drop dead firewall block (firewall off in image.nix -> trustedInterfaces
  was a no-op). Cilium manages pod networking via BPF.
- image.baseName=heather, configurationLimit=1, remove virtio dups (qemu-guest
  profile already provides most).
- Fix sha256 pin on forgejo mikl.keys (was stale, would break fetchurl).
- home/zsh.nix: source yandex-cloud yc completion.

hosts/heather/default.nix

@@ -0,0 +1,39 @@
+# heather — k3s single-node cluster на YC (NixOS 25.11, собирается как qcow2-образ)
+# https://git.iscg.dev/mikl/nix-config
+#
+# Перенесено из muscari (переименование 2026-07-11).
+# VM на Yandex Cloud, 2 vCPU / 8 GB / 64 GB SSD (network-ssd), Legacy BIOS.
+# Образ NixOS собирается как qcow2 (см. ./image.nix, make-disk-image.nix) и
+# заливается как boot disk в YC. НЕ через nixos-anywhere — kexec на YC хрупкий.
+# См. memory/yandex-nixos-qcow2.md.
+
+{ config, pkgs, lib, ... }:
+{
+  imports = [
+    ./image.nix   # YC guest profile + qcow2 build target (заменяет disk-config.nix)
+    ./k3s.nix
+  ];
+
+  networking = {
+    hostName = "heather";
+    firewall.allowedTCPPorts = [
+      22    # SSH
+      80    # HTTP (Ingress через Traefik)
+      443   # HTTPS (Ingress через Traefik)
+      # 6443 не открываем — kubectl через SSH-туннель
+    ];
+  };
+  # useDHCP задаёт ./image.nix (mkDefault) — облачный профиль.
+
+  # SSH ключи для mikl: forgejo .keys endpoint с sha256-pinning.
+  # Poppy-ключ (этот ноутбук) лежит там последней строкой.
+  users.users.mikl.openssh.authorizedKeys.keyFiles = [
+    (pkgs.fetchurl {
+      url = "https://git.iscg.dev/mikl.keys";
+      sha256 = "sha256-Omc/3NJn0nM8SWeF33trFwOAVgSX0fXB5dfEakcRoTA=";
+    })
+  ];
+
+  # После первой установки 25.11 не трогаем (NixOS convention)
+  system.stateVersion = "25.11";
+}