feat(clan): re-enable dm-pull-deploy via forked clan-community 🌊

Stage 4e, take 2. Point the clan-community input at our fork's branch
that sanitizes machine.name for data-mesher's file-name validator
(upstream PR: clan/clan-community#25). Revisit this pin once merged.

- flake.nix: clan-community.url → fork + fix branch
- flake-modules/clan.nix: re-adds meta.domain = "clan",
  inventory.instances.data-mesher (sunken-ship bootstrap, both default),
  inventory.instances.dm-pull-deploy (sunken-ship push, both default
  action="switch"), and clanHostsModule that puts /etc/hosts entries
  for <host>.clan → each machine's ZT IPv6 so libp2p multiaddr
  resolution works without a clan-domain DNS server.
- Generator vars for data-mesher + dm-pull-deploy signing keys were
  regenerated on sunken-ship (data-mesher isn't packaged for
  aarch64-darwin, so clan vars generate runs on Linux).

vars/per-machine/phantom-ship/dm-pull-deploy-status-key/signing.key/machines/phantom-ship

@@ -0,0 +1 @@
+../../../../../../sops/machines/phantom-ship

vars/per-machine/phantom-ship/dm-pull-deploy-status-key/signing.key/secret

@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:AabxVdVuPRrmARrCTedX0uwlVm1GVSCBJUo6fMCaHujCcPgx98lvj3o4RCBzfO/mFQ9W/cKbtisJjpoTBr4NRmldKCGQRmcKqeOfPIISjDLKe7nPxvQzmcZNySzkGMLlhgCPX9o0GZBWRKKPJdZaj8piXEFOijI=,iv:fyj9aqjf20QYFP/FBMWHe570lBaW+i33yKtnI3LIZ9c=,tag:iS6727dL1BK3DYGc3wYrKw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age18gtjh28qxeltg2r2tzxwl096crkqkqk8tjhersyf7mzdsddady7qs34x0m",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArdnRRaVo4b2pLU3BSR212\nNVErNjVWUzZLQTVITVpYUXJKcWtjb3NEQ1FVCjRJUFBtS3NlUHlEUXViTkNaMmxy\nTTZyaWZWSlhZVG1zMjdCUnpYL3gyaVkKLS0tIGhkd01JQnpWeXdOSXBoeGJpVkgr\ndmh6RFJISnI3VUFpbXRPWnFicG8wTTQK1/1lyVDvmEmA/FaYb4Xh8u4ni/1bLszK\nVfyeFyJAIWlZmrvdDDovhdF1kRoywMd1e4yOsA3nzgRRSKmL8oLo/Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1g6y8gvcampqj5y3yzdajke2h5n7k6ckdg6a424cghy5325px7cmqjmmd28",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwVUFXUmlPbUdzam42Uzlp\nT0FBekRpS0djS1ArWGw1aFhrUDNDcGFZaTNRClZpTWY3SE1ld3JzZGdkODVnOStI\nVDRDODRBQ3Z3Q2wvVk1kVE94NmtjUVEKLS0tIGN2c29yR041bWJNOVlvYVVtTW12\nNnk2VjJkV0Vjb0UwSWorWVdRK21TZ3MKdLb8G7L0UG79OQ7RPooeXnRMV+cPA9Na\n/AeBv/dfrO1ScRxUb5px8EDtO2NAr32JdSNrgb98CQeveC2MuPSeXA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-04-20T17:57:26Z",
+		"mac": "ENC[AES256_GCM,data:UYlO50InICGG4KGIe+YB/Cu3d47u8hoby3mNZvwigkn86bfQImbAQdAlcyR3aGN6fzY41STDNEgZ+aP16gQzX8/MyIy17qHLOQs4SXcd9YW7uL8KmxkBcEAgEQ8XzH6eo8Y0I2nHxrhPATXVGfGV8qB2kky4PIMTl5pH4myZLgI=,iv:eF6ktICycC+IuYv6b1rTC7SsZkb96ev4zhmDbyU763w=,tag:w1ljE1/Iq/C+9bx+IyuAhw==,type:str]",
+		"version": "3.12.2"
+	}
+}

vars/per-machine/phantom-ship/dm-pull-deploy-status-key/signing.key/users/danny

@@ -0,0 +1 @@
+../../../../../../sops/users/danny