CLAUDE.md: sync docs with current config

Update for the 26.05 bump and host changes: 8 hosts, orion is now a
server, straylight/svc added, vade on desktop-light, MCP modules,
and the current LUKS coverage.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CLAUDE.md

@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## What This Is
 
-A flake-based NixOS configuration managing 6 hosts (all x86_64-linux). Pinned to nixpkgs `nixos-25.11`.
+A flake-based NixOS configuration managing 8 hosts (all x86_64-linux). Pinned to nixpkgs `nixos-26.05`, with `nixos-unstable` available as a secondary input for select packages.
 
 ## Common Commands
 
@@ -34,16 +34,19 @@ Each host has a directory under `hw/<hostname>/` containing:
 - `hardware-configuration.nix` — auto-generated hardware config
 - `disk-config.nix` — disko disk layout (where applicable)
 
-Desktop hosts (imladris, orion, vade, ono-sendai) import `configs/desktop.nix` and `configs/qemu.nix`.
+Full desktop hosts (imladris, ono-sendai, straylight) import `configs/desktop.nix`; vade is a lightweight desktop importing `configs/desktop-light.nix`. Most desktops also import `configs/qemu.nix`.
-Server hosts (rift, sk) are minimal — hardware config + disk config only.
+Server hosts (orion, rift, sk, svc) have no desktop environment; sk is minimal (hardware config + disk config only).
+Hosts participating in the MCP (Metacircular Control Plane) import `configs/mcp.nix` and `configs/mcpkg.nix`; straylight is becoming the core MCP host.
 
 ### Shared Modules (`configs/`)
 
 - `pkgs.nix` — system-wide packages
-- `desktop.nix` — GDM + i3, PipeWire audio, Bluetooth, CUPS
+- `desktop.nix` — full desktop (builds on desktop-light.nix)
-- `desktop-packages.nix` — GUI applications (imported by desktop.nix)
+- `desktop-light.nix` — baseline lightweight desktop
+- `desktop-packages-full.nix` / `desktop-packages-light.nix` — GUI applications
 - `git.nix` — git identity config
 - `qemu.nix` — QEMU/KVM virtualization
+- `mcp.nix` / `mcpkg.nix` — MCP agent user/service and MCP packages
 
 ### Key Design Decisions
 
@@ -52,5 +55,5 @@ Server hosts (rift, sk) are minimal — hardware config + disk config only.
 - **No secrets manager** — SSH keys via gpg-agent, `doas` (not sudo) for privilege escalation
 - **Podman** with Docker compatibility enabled on all hosts
 - **Tailscale** and **Syncthing** enabled on all hosts
-- **LUKS encryption** on some hosts (rift, ono-sendai)
+- **LUKS encryption** on most hosts (all except sk and svc)
 - `inputs` are passed to modules via `specialArgs`