fix: allow AF_UNIX sockets for nix daemon communication

The flake collector needs Unix domain sockets to communicate with the
nix daemon. The RestrictAddressFamilies hardening was blocking this.
Also trim trailing newlines from stderr in error messages.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

collector/flake.go

@@ -191,7 +191,7 @@ func fetchFlakeMetadata(flakeURL string) (*flakeMetadata, error) {
 	output, err := cmd.Output()
 	if err != nil {
 		if exitErr, ok := err.(*exec.ExitError); ok {
-			return nil, fmt.Errorf("nix flake metadata failed: %s", string(exitErr.Stderr))
+			return nil, fmt.Errorf("nix flake metadata failed: %s", strings.TrimSpace(string(exitErr.Stderr)))
 		}
 		return nil, fmt.Errorf("nix flake metadata failed: %w", err)
 	}