Ansible orchestrates, Nix declares
Ansible renders the flake, moves secrets and drives the rebuild. It
never mutates the running system — no package installs, no lines edited
into /etc. If something can't be expressed in the flake,
that's a design bug, not a licence to reach for a shell.