chore(flake): treefmt + deadnix/statix + pre-commit; relocate work module

- treefmt-nix drives `nix fmt` and the formatting check (nixfmt/shfmt/
  prettier; generated files and flake.lock excluded). Replaces the
  bespoke find-based check.
- deadnix and statix as flake checks and pre-commit hooks; deadnix
  ignores module-arg patterns, statix.toml disables the two house-style
  lints (repeated_keys, empty_pattern). Fixed the one real deadnix hit
  (unused overlay arg) and statix hit (use inherit for claude-code).
- git-hooks.nix installs the pre-commit gate via the devShell.
- .editorconfig for the base style.
- Move system/modules/work/default.nix -> lyrathorpe/home/work.nix (it is
  a home-manager module). README gains a Development section; docs
  reformatted by the new formatter.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

flake.nix

@@ -66,11 +66,13 @@
         # claude-code tracks nixpkgs-unstable regardless of the pinned nixpkgs.
         overlays = [
           (_final: prev: {
-            claude-code =
+            inherit
               (import nixpkgs-unstable {
                 inherit (prev.stdenv.hostPlatform) system;
                 config.allowUnfree = true;
-              }).claude-code;
+              })
+              claude-code
+              ;
           })
         ];
 
@@ -309,20 +311,28 @@
               programs.shfmt.enable = true;
               programs.prettier.enable = true;
               # Generated hardware-configuration.nix files are not hand-edited.
-              settings.global.excludes = [ "*/hardware-configuration.nix" ];
+              settings.global.excludes = [
+                "*/hardware-configuration.nix" # generated by nixos-generate-config
+                "flake.lock" # generated by `nix flake lock`
+              ];
             };
 
             # Pre-commit hooks: format + lint gate run on commit. The same hooks
             # are exposed as a flake check (pre-commit.check.enable defaults true).
-            pre-commit.settings.hooks = {
-              nixfmt-rfc-style.enable = true;
-              deadnix = {
-                enable = true;
-                # Unused module args ({config,lib,pkgs,...}) are normal; only flag
-                # genuinely dead bindings.
-                settings.noLambdaPatternNames = true;
+            pre-commit.settings = {
+              # Generated by nixos-generate-config; don't lint/reformat (treefmt
+              # excludes them too).
+              excludes = [ "hardware-configuration\\.nix$" ];
+              hooks = {
+                nixfmt-rfc-style.enable = true;
+                deadnix = {
+                  enable = true;
+                  # Unused module args ({config,lib,pkgs,...}) are normal; only
+                  # flag genuinely dead bindings.
+                  settings.noLambdaPatternNames = true;
+                };
+                statix.enable = true; # reads statix.toml (repeated_keys/empty_pattern disabled)
               };
-              statix.enable = true; # reads .statix.toml (repeated_keys/empty_pattern disabled)
             };
 
             # treefmt-nix exposes its own `checks.treefmt`; alias it to
@@ -336,7 +346,7 @@
               deadnix --fail --no-lambda-pattern-names ${./.} && touch $out
             '';
             checks.statix = pkgs.runCommandLocal "check-statix" { nativeBuildInputs = [ pkgs.statix ]; } ''
-              statix check ${./.} && touch $out
+              statix check -c ${./.} ${./.} && touch $out
             '';
 
             # `nix develop` shell with the tooling needed to hack on this flake.