fix: disable PrivateDevices to allow nix sandbox namespace creation

The PrivateDevices=true systemd hardening option was preventing Nix
from creating the kernel namespaces required for its build sandbox.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

nixos/module.nix

@@ -132,7 +132,7 @@ in
         ProtectSystem = "false";
         ProtectHome = "read-only";
         PrivateTmp = true;
-        PrivateDevices = true;
+        PrivateDevices = false;
         ProtectKernelTunables = true;
         ProtectKernelModules = true;
         ProtectControlGroups = true;