docs: condense comments across the repo

Comments had drifted into multi-paragraph narrative (git commit
lineage, debugging stories, restated code) in several hot spots
(scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix).
Trim every comment to its load-bearing "why" — gotchas, safety
warnings, and non-obvious rationale survive verbatim in substance,
just tightened to 1-2 sentences; historical narrative and anything
already covered in CLAUDE.md is cut. No code/logic changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21

hosts/terra/home.nix

@@ -2,23 +2,17 @@
 let
   tome = pkgs.callPackage ../../pkgs/tome.nix { src = inputs.tome; };
 
-  # SUDO_ASKPASS helper: renders sudo's password prompt in the quickshell
-  # shell (HyprChrome/Widgets/Askpass) instead of on the terminal.
+  # SUDO_ASKPASS helper: shows sudo's password prompt in quickshell
+  # (HyprChrome/Widgets/Askpass) instead of the terminal. sudo doesn't speak
+  # polkit (setuid + PAM reading the tty), so this reuses the polkit dialog's
+  # look via the askpass mechanism instead — `run0` is the actual polkit-native
+  # alternative.
   #
-  # sudo does NOT speak polkit — it is setuid + PAM reading the tty, and no
-  # sudoers option bridges the two — so this is the askpass mechanism, a
-  # separate path that happens to reuse the polkit dialog's look. `run0` is the
-  # polkit-native alternative if you want the agent itself.
+  # Must be a package, not a dotfiles file: SUDO_ASKPASS needs an executable,
+  # and xdg.configFile copies keep store-copy permissions.
   #
-  # A package rather than a file in dotfiles/quickshell because SUDO_ASKPASS
-  # must point at something EXECUTABLE, and xdg.configFile copies keep their
-  # store mode — which is why open_launcher.sh has to be invoked as
-  # `bash <path>` rather than run directly.
-  #
-  # The secret comes back over a 0600 fifo, never in argv or the environment,
-  # so it is not visible in /proc to anything. Cancelling closes the fifo
-  # without writing: `cat` reads nothing, this exits non-zero, and sudo aborts
-  # instead of burning a retry on an empty password.
+  # The secret returns over a 0600 fifo (never argv/env, so not visible in
+  # /proc); cancelling closes the fifo unwritten so sudo aborts cleanly.
   qs-askpass = pkgs.writeShellApplication {
     name = "qs-askpass";
     runtimeInputs = [ pkgs.quickshell pkgs.coreutils ];
@@ -74,11 +68,9 @@ in
     nix-direnv.enable = true;
   };
 
-  # Rootless podman: containers run as darman, not root. services/containers.nix
-  # gives us the `docker` CLI shim (dockerCompat), but compose v2 is a separate
-  # binary and talks to a socket rather than the CLI — the NixOS podman module
-  # enables the *user* socket (systemd.user.sockets.podman), so point compose at
-  # it instead of the root /var/run/docker.sock.
+  # Rootless podman runs containers as darman; compose v2 talks to a socket
+  # rather than the docker CLI shim, so point it at the user podman socket
+  # instead of the root one.
   home.sessionVariables.DOCKER_HOST = "unix:///run/user/1000/podman/podman.sock";
 
   # Only sets WHICH helper sudo uses; it still only calls it when asked with