Enable Homebrew zap, restore boto3 for ansible, verify signatures

Enable Homebrew zap, restore boto3 for ansible, verify signatures Three follow-ups to the migration. Homebrew cleanup goes from "none" to "zap". Audited first, because zap removes anything undeclared on every activation along with its application support and preference files. It will remove: font-fira-code-nerd-font (nixpkgs provides the font now), the sshpass formula and the hudochenkov/sshpass tap (nixpkgs provides sshpass), the stale oven-sh/bun tap, and nvm, which has no ~/.nvm directory and is unused. The audit also turned up gopls, installed via Homebrew and declared nowhere, which zap would have silently deleted. It is in nixpkgs at 0.23.0 and is now declared in packages.nix instead. ansible gets boto3 and botocore back, injected with overridePythonAttrs so it stays a normal top-level package rather than returning to a python3.withPackages environment. Verified by inspecting the built closure: python3.14-boto3-1.42.31 and python3.14-botocore-1.42.31 are present. amazon.aws modules should import again. gpg.ssh.allowedSignersFile is configured, with an allowed_signers file mapping all three author addresses used in this repo to the public half of the 1Password signing key. Signing already worked; verification did not, which is why every commit reported "N" under %G?.