nix: split the cc-ci-specific config into its own module + flake output

The orchestrator host is a general agent box that also serves several unrelated
projects (atproto-likes, the lichen and project orchestrators, the shared
opencode web server). Everything that exists FOR cc-ci — the loops, the cc-ci
orchestrator session, the weekly recipe-upgrade run and its hourly supervisor —
now lives in nix/modules/cc-ci.nix and is exported as `nixosModules.cc-ci`, so
the two can evolve and be reviewed independently and another host can consume
just the cc-ci half.

No behaviour change. Verified by building .#cc-ci-orchestrator-hetzner after the
split: the unit set is identical to the running system, and all six cc-ci units
are byte-identical modulo nix store hashes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016L6nYYwkCWnrEFKTnKAfet

flake.nix

@@ -18,6 +18,11 @@
       system = "x86_64-linux";
     in
     {
+      # The cc-ci part of a host, on its own, so a host that runs cc-ci can import just this and
+      # keep its own (unrelated) configuration separate. Split out 2026-08-20; consumed by
+      # notplants-nix's `notplants-orchestrator` host.
+      nixosModules.cc-ci = ./nix/modules/cc-ci.nix;
+
       # Hetzner cpx11 host (nixos-infect generated hardware.nix + orchestrator config).
       # Provision with terraform/ then run Stage 2 per terraform/README.md.
       nixosConfigurations.cc-ci-orchestrator-hetzner = nixpkgs.lib.nixosSystem {