fix(nix): stop automatic rebuilds and nightly GC from tripping GitHub's rate limit

autoUpgrade was silently failing daily on both hosts (legacy channel path,
no --flake set) without reaching the network — disabled outright since
rebuilds should only happen manually. Separately, nix-gc.timer's nightly
sweep was deleting eval-time-only flake input sources (not part of the
runtime closure), forcing the next evaluation to cold-refetch hermes-agent's
entire dependency tree from GitHub in one burst, which alone was enough to
hit the unauthenticated codeload rate limit. keep-outputs/keep-derivations
stop GC from evicting those sources.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TJS8qsYPXSUm5mdWGdaHjF

machines/core/nix.nix

@@ -12,6 +12,13 @@
 
     settings = {
       auto-optimise-store = true;
+      # Without these, gc sweeps away eval-time-only sources (flake inputs,
+      # their build deps) since they're not part of the runtime closure.
+      # The next evaluation then cold-refetches everything from GitHub,
+      # which is enough on its own to trip GitHub's unauthenticated rate
+      # limit for large dependency trees (e.g. hermes-agent's).
+      keep-outputs = true;
+      keep-derivations = true;
     };
 
     gc = {