feat: add restricted smart-home agent user

[ajaxbits]

Summary

• Declare the smarthome-editors group on Patroclus.
• Declare the locked smarthome-agent user with Fish as its shell.
• Add smarthome-editors to the existing admin user.
• Keep the agent out of wheel, docker, and other privileged groups.

This replaces imperative account creation in scripts/prepare-agent-workspace.fish with NixOS-managed users and groups.

Validation

• nix eval --json .#nixosConfigurations.patroclus.config.users.users.smarthome-agent ...
• nix eval --json .#nixosConfigurations.patroclusStripped.config.users.users.smarthome-agent ...
• Full and stripped Patroclus system derivations evaluate successfully.
• git diff --check

The repository-wide nix flake check --no-build remains blocked by an existing unrelated agenix-0.15.0 evaluation error: substituteAll has been removed; use replaceVars instead.