docs: document the audit improvements; fix remaining stale work refs

Update the home README (editor plugins + format-on-save, btop/lazygit/
hyperfine/sd, git aliases, tmux extrakto, fonts/emoji coverage),
KEYBINDINGS (telescope/trouble/comment), and the top README (shared
module layers + nix-flake-check CI). Correct the last work/default.nix
reference in default.nix.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -16,8 +16,11 @@ Defined in the host table in [`flake.nix`](./flake.nix):
 | `lyrathorpe-mac`      | `aarch64-darwin` | macOS (nix-darwin)                                                          |
 
 Shared layers: `lyrathorpe/home` (home-manager: shell, git, editor),
-`system/modules/common-nixos.nix` (all NixOS hosts), and
-`system/modules/laptop.nix` (the physical laptops).
+`system/modules/common-nixos.nix` (all NixOS hosts: fonts, nix-ld, caches),
+`system/modules/workstation.nix` (physical graphical hosts: audio, thermald,
+earlyoom, fwupd), `system/modules/laptop.nix` (laptops: Wi-Fi, Bluetooth, power,
+lid), and `system/modules/ssh.nix` (key-only sshd). The x86 hosts also pull
+`nixos-hardware` profiles.
 
 ## Applying
 
@@ -74,5 +77,6 @@ A dev shell and a formatting/lint gate are wired through the flake:
 
 ## CI
 
-[`.gitea/workflows/ci.yaml`](./.gitea/workflows/ci.yaml) gates `nixfmt`
-formatting and evaluates every NixOS and Darwin host configuration on push/PR.
+[`.gitea/workflows/ci.yaml`](./.gitea/workflows/ci.yaml) runs `nix flake check`
+(formatting, `deadnix`, `statix`, the pre-commit hooks) and evaluates every
+NixOS and Darwin host configuration on push/PR.