chore(flake): treefmt + deadnix/statix + pre-commit; relocate work module

- treefmt-nix drives `nix fmt` and the formatting check (nixfmt/shfmt/
  prettier; generated files and flake.lock excluded). Replaces the
  bespoke find-based check.
- deadnix and statix as flake checks and pre-commit hooks; deadnix
  ignores module-arg patterns, statix.toml disables the two house-style
  lints (repeated_keys, empty_pattern). Fixed the one real deadnix hit
  (unused overlay arg) and statix hit (use inherit for claude-code).
- git-hooks.nix installs the pre-commit gate via the devShell.
- .editorconfig for the base style.
- Move system/modules/work/default.nix -> lyrathorpe/home/work.nix (it is
  a home-manager module). README gains a Development section; docs
  reformatted by the new formatter.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -7,13 +7,13 @@ single flake.
 
 Defined in the host table in [`flake.nix`](./flake.nix):
 
-| Configuration       | System          | Machine                                  |
-| ------------------- | --------------- | ---------------------------------------- |
-| `lyrathorpe-mbp`      | `aarch64-linux`  | MacBook Pro (Apple Silicon, Asahi)                                  |
-| `lyrathorpe-t400`     | `x86_64-linux`   | ThinkPad T400 — [install notes](./system/machine/T400/README.md)   |
+| Configuration         | System           | Machine                                                                     |
+| --------------------- | ---------------- | --------------------------------------------------------------------------- |
+| `lyrathorpe-mbp`      | `aarch64-linux`  | MacBook Pro (Apple Silicon, Asahi)                                          |
+| `lyrathorpe-t400`     | `x86_64-linux`   | ThinkPad T400 — [install notes](./system/machine/T400/README.md)            |
 | `lyrathorpe-macpro31` | `x86_64-linux`   | Mac Pro 3,1, desktop — [install notes](./system/machine/MacPro31/README.md) |
-| `emmathorpe-edaas`    | `x86_64-linux`   | Work WSL box (NixOS-WSL)                                            |
-| `lyrathorpe-mac`      | `aarch64-darwin` | macOS (nix-darwin)                                                  |
+| `emmathorpe-edaas`    | `x86_64-linux`   | Work WSL box (NixOS-WSL)                                                    |
+| `lyrathorpe-mac`      | `aarch64-darwin` | macOS (nix-darwin)                                                          |
 
 Shared layers: `lyrathorpe/home` (home-manager: shell, git, editor),
 `system/modules/common-nixos.nix` (all NixOS hosts), and
@@ -48,14 +48,29 @@ WSL work box) keep plain TTY login. The target account needs a password
 ## MacBook (Asahi) firmware
 
 The MBP host references `system/modules/firmware/` for Apple peripheral
-firmware (Wi-Fi/Bluetooth). Those blobs are **not** redistributable, so the
-directory is gitignored and a clean checkout will not build `lyrathorpe-mbp`
-until it is populated out-of-band.
+firmware (Wi-Fi/Bluetooth). These blobs are **committed** (tracked) even though
+`.gitignore` lists the directory: the flake is `git+file`, so it only sees
+tracked files — untracking them breaks `lyrathorpe-mbp` evaluation (and the CI
+host-eval) because the config can't find the firmware. They are not
+redistributable; the repo is private.
 
-Copy the firmware extracted during the Asahi install (from
-`/etc/nixos/firmware` on the freshly-installed machine, or re-extract per the
+To refresh them, copy the firmware extracted during the Asahi install (from
+`/etc/nixos/firmware`, or re-extract per the
 [Asahi NixOS docs](https://github.com/tpwrules/nixos-apple-silicon)) into
-`system/modules/firmware/` before rebuilding that host.
+`system/modules/firmware/` and commit with `git add -f`.
+
+## Development
+
+A dev shell and a formatting/lint gate are wired through the flake:
+
+- `nix develop` — shell with `deadnix`, `statix`, `treefmt`, and the git
+  `pre-commit` hooks (installed automatically on first entry).
+- `nix fmt` — formats the tree via `treefmt` (nixfmt + shfmt + prettier;
+  generated files and `flake.lock` are excluded).
+- `nix flake check` — runs formatting, `deadnix`, `statix`, the pre-commit
+  hooks, and evaluates every host. `.editorconfig` carries the base style;
+  `statix.toml` disables the two house-style lints (`repeated_keys`,
+  `empty_pattern`).
 
 ## CI