docs: condense comments across the repo

Comments had drifted into multi-paragraph narrative (git commit
lineage, debugging stories, restated code) in several hot spots
(scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix).
Trim every comment to its load-bearing "why" — gotchas, safety
warnings, and non-obvious rationale survive verbatim in substance,
just tightened to 1-2 sentences; historical narrative and anything
already covered in CLAUDE.md is cut. No code/logic changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21

hosts/terra/home/theme.nix

@@ -23,14 +23,11 @@ in
     };
   };
 
-  # The cursor theme. XCURSOR_THEME alone is not enough for Steam: the client
-  # UI (steamwebhelper) runs inside a pressure-vessel container that rebuilds
-  # /etc, so the /etc/profiles/per-user/darman/share/icons entry of
-  # XCURSOR_PATH does not exist in there and libXcursor finds no theme by
-  # that name — it falls back to the built-in core X11 cursor. $HOME and
-  # /nix are bind-mounted into the container, so the ~/.icons symlink that
-  # `dotIcons` (on by default) drops does resolve. Same class of problem as
-  # the ~/.themes/~/.icons flatpak workaround above.
+  # XCURSOR_THEME alone isn't enough for Steam: steamwebhelper runs inside a
+  # pressure-vessel container with its own /etc, so XCURSOR_PATH doesn't
+  # resolve there and it falls back to the core X11 cursor. $HOME and /nix are
+  # bind-mounted in though, so the ~/.icons symlink `dotIcons` drops still
+  # resolves — same fix as the flatpak workaround below.
   home.pointerCursor = {
     name = "Bibata-Modern-Classic";
     package = pkgs.bibata-cursors;
@@ -39,11 +36,9 @@ in
     hyprcursor.enable = true;
   };
 
-  # Flatpak apps are sandboxed and can't see XDG_DATA_DIRS/nix-store theme
-  # paths, so the portal-reported GTK theme / icon theme names resolve to
-  # nothing inside the sandbox and they fall back to Adwaita. Flatpak
-  # auto-exposes ~/.themes and ~/.icons read-only to every sandboxed app
-  # specifically for this case.
+  # Flatpak apps can't see XDG_DATA_DIRS/nix-store theme paths, so the
+  # portal-reported theme names resolve to nothing and fall back to Adwaita;
+  # Flatpak auto-exposes ~/.themes and ~/.icons read-only as the workaround.
   home.file.".themes/Dracula".source =
     "${pkgs.dracula-theme}/share/themes/Dracula";
   home.file.".icons/${iconTheme}".source = iconThemeFolder;