docs: condense comments across the repo

Comments had drifted into multi-paragraph narrative (git commit
lineage, debugging stories, restated code) in several hot spots
(scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix).
Trim every comment to its load-bearing "why" — gotchas, safety
warnings, and non-obvious rationale survive verbatim in substance,
just tightened to 1-2 sentences; historical narrative and anything
already covered in CLAUDE.md is cut. No code/logic changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21

hosts/terra/disk-config.nix

@@ -5,27 +5,14 @@
 # `fileSystems.*` entries, so hardware-configuration.nix must NOT define
 # fileSystems for "/" or "/boot".
 #
-# ⚠️  disko's `mkfs` create step SKIPS formatting when `blkid` still detects a
-#     filesystem signature on the freshly-cut partition:
-#
-#       if ! (blkid "$device" -o export | grep -q '^TYPE='); then
-#         mkfs.btrfs "$device" -f     # ← -f only runs WHEN this line runs
-#       fi
-#
-#     The disk previously held a CachyOS btrfs root. The whole-disk `wipefs`
-#     disko runs before partitioning clears the signature at the OLD layout's
-#     offsets, but `sgdisk --clear --align-end` then re-cuts the partitions, so
-#     a stale btrfs superblock survives at the NEW root partition's own 64 KiB
-#     offset. `blkid` sees TYPE=btrfs, `mkfs` is skipped entirely, and the
-#     later `mount` fails on the leftover bytes ("wrong fs type / bad
-#     superblock"). Switching ext4→btrfs did NOT fix this: `mkfs.btrfs -f` is
-#     never reached, because the guard is on whether `mkfs` runs at all, not on
-#     its flags. The ESP hits the same trap (its `mkfs.vfat` gets skipped too).
-#
-#     Fix: `preCreateHook = wipefs --all --force "$device"` on each partition's
-#     content. The hook runs AFTER sgdisk re-cuts the partition but BEFORE the
-#     `blkid` guard, so it erases the stale signature at the FINAL offset;
-#     `blkid` then comes back empty and `mkfs` actually runs.
+# ⚠️  disko's `mkfs` step skips formatting if `blkid` still detects a
+#     filesystem signature on the partition. Repartitioning doesn't erase
+#     signatures at the new offsets, so this disk's old CachyOS btrfs
+#     superblock survived, causing mkfs (and the ESP's mkfs.vfat) to be
+#     skipped and the later mount to fail on the stale superblock.
+#     Fix: `preCreateHook = wipefs --all --force "$device"` on each
+#     partition — it runs after sgdisk re-cuts the partition but before the
+#     `blkid` guard, so the guard sees no signature and `mkfs` actually runs.
 #
 # ⚠️  This disk is WIPED on install. This is the Kingston SA400 SSD that
 #     currently holds CachyOS (btrfs root+subvols on sdb2, ESP on sdb1).
@@ -58,8 +45,7 @@
             type = "btrfs";
             extraArgs = [ "-f" ];
             mountpoint = "/";
-            # erase the stale CachyOS btrfs superblock before disko's blkid
-            # format-guard, otherwise mkfs.btrfs is skipped (see header comment)
+            # same wipefs fix as the ESP above (see header comment)
             preCreateHook = ''wipefs --all --force "$device"'';
           };
         };