The flake collector needs Unix domain sockets to communicate with the nix daemon. The RestrictAddressFamilies hardening was blocking this. Also trim trailing newlines from stderr in error messages. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>