docs: condense comments across the repo

Comments had drifted into multi-paragraph narrative (git commit
lineage, debugging stories, restated code) in several hot spots
(scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix).
Trim every comment to its load-bearing "why" — gotchas, safety
warnings, and non-obvious rationale survive verbatim in substance,
just tightened to 1-2 sentences; historical narrative and anything
already covered in CLAUDE.md is cut. No code/logic changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21

pkgs/azure-glassy-dark-icons.nix

@@ -17,13 +17,11 @@ stdenvNoCC.mkDerivation {
 
   dontBuild = true;
 
-  # Upstream ships a handful of dangling symlinks under mimetypes/16 (e.g.
-  # libreoffice-spreadsheet.svg -> libreoffice-oasis-spreadsheet.svg, which
-  # doesn't exist in that size dir) — a minor packaging bug in the theme
-  # itself. Harmless: GTK's icon lookup just falls through to the theme's
-  # own Inherits= chain (breeze-dark, breeze, Adwaita, hicolor) for those few
-  # mimetypes. Nixpkgs' default noBrokenSymlinks fixup check would otherwise
-  # fail the whole build over it.
+  # Upstream ships a handful of dangling symlinks under mimetypes/16 (e.g. a
+  # target that doesn't exist in that size dir) — harmless, GTK's own
+  # Inherits= chain (breeze-dark, breeze, Adwaita, hicolor) covers the
+  # fallback. Nixpkgs' default noBrokenSymlinks check would otherwise fail
+  # the build over it.
   dontCheckForBrokenSymlinks = true;
 
   # gtk3's setup hook strips icon-theme.cache from $out by default

pkgs/slot-beauty-dark-icons.nix

@@ -21,15 +21,11 @@ stdenvNoCC.mkDerivation {
   # the theme's own Inherits= chain (breeze-dark, Adwaita, hicolor) for those.
   dontCheckForBrokenSymlinks = true;
 
-  # index.theme's Directories= lists panel/16@2, panel/22@2, panel/24@2 (with
-  # Scale=2), but the actual on-disk dirs are named 16@2x/22@2x/24@2x (the
-  # correct freedesktop-spec suffix) — an upstream index.theme typo. That
-  # mismatch makes `gtk-update-icon-cache` refuse to emit ANY cache at all
-  # (exits 1, "The generated cache was invalid"), so unlike the other vendored
-  # themes here, this one ships with no icon-theme.cache and relies on GTK's
-  # live directory-scan lookup instead — functionally fine, just not
-  # cache-accelerated. gtk3's default postFixup hook (dropIconThemeCache)
-  # would strip a cache anyway, so there's nothing to opt out of.
+  # index.theme's Directories= names panel/16@2 etc. (Scale=2) but the
+  # on-disk dirs are 16@2x etc. (the correct suffix) — an upstream typo that
+  # makes `gtk-update-icon-cache` exit 1, so this theme ships uncached and
+  # relies on GTK's live directory scan instead (functionally fine, just not
+  # cache-accelerated).
   installPhase = ''
     runHook preInstall
     mkdir -p "$out/share/icons"

pkgs/tome.nix

@@ -56,13 +56,11 @@ buildDotnetModule (finalAttrs: {
 
   executables = [ "Tome.App" ];
 
-  # wrapGAppsHook3: buildDotnetModule sets dontWrapGApps = true by default (to
-  # avoid double-wrapping) but its own wrap step still splices gappsWrapperArgs
-  # in when the hook is present (see nixpkgs' libation package, same pattern).
-  # Without it the binary never gets XDG_DATA_DIRS/GSETTINGS_SCHEMA_DIR set, so
-  # GTK/WebKitGTK can't find the icon theme or GTK settings from the desktop
-  # session — symptoms: missing icons and a denser default UI font/size than
-  # when launched from an already-fully-initialized session (e.g. via Rider).
+  # buildDotnetModule sets dontWrapGApps = true by default, but wrapGAppsHook3's
+  # own wrap step still splices gappsWrapperArgs in when present (same pattern
+  # as nixpkgs' libation). Without it XDG_DATA_DIRS/GSETTINGS_SCHEMA_DIR never
+  # get set, so GTK/WebKitGTK can't find the icon theme or settings — missing
+  # icons, denser default UI font.
   nativeBuildInputs = [ copyDesktopItems wrapGAppsHook3 ];
 
   runtimeDeps = [