Read-only audit (adversarially verified each item is unreferenced):
- secrets: drop orphan skydick-wg.age + xlab-wg-warp.age (declared in
  secrets.nix but wired into no age.secrets block, decrypted nowhere —
  an unbuilt WARP exit + an unused skydick WG key)
- skydick: drop ethtool ring-buffer tuning loop over the torn-down bond0
  NICs (enp4s0f0np0/enp4s0f1np1, standalone-down since the 2026-05-15
  cutover) + the now-unused pkgs.ethtool from the unit path
- xlab-gateway: drop stale "migrate from Debian" TODO (already NixOS),
  phantom networkmanager group membership (NM never enabled), and a
  commented-out dead route; replace Chinese comment banners with English
  (routes preserved — they are load-bearing)

Co-Authored-By: Claude Opus 4.8 <[email protected]>