Locks in host (mibook, not jupiter), deployment mode (NixOS native module), and auth (claude setup-token / ANTHROPIC_TOKEN, Max extra credits) after a grilling round. Builds on feat/sops-nix as-is. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Vbvwg3Qt2u9nbkEA3wL17S