Port macOS defaults to nix-darwin

Port macOS defaults to nix-darwin Replaces defaults.sh with declarative, idempotent settings. All 43 `defaults write` calls are accounted for, verified by evaluating the rendered config and diffing the domain/key pairs against the old script. 32 map to typed nix-darwin options across dock, finder, NSGlobalDomain, WindowManager, menuExtraClock and trackpad. Note the domain rename: com.apple.menuextra.clock is system.defaults.menuExtraClock. 11 have no option and go through CustomUserPreferences: FXPreferredGroupBy, the 11 text replacements, the 5 Rectangle keys, the Raycast hotkey, and the three disabled hot corners. That last group is not an oversight - the wvous-*-corner options are typed ints.positive, which rejects the 0 that disables a corner, so only the enabled corner (bottom left, Quick Note) can use the typed option. Two things worth recording: - enableKeyMapping must be on or remapCapsLockToControl is silently a no-op. nix-darwin warns about this at eval time; it is easy to miss. - finder.NewWindowTarget = "Home" renders as PfHm, matching the old script. Verified rather than assumed. Deletes the capslock LaunchAgent, which duplicated the same remap. It is still installed under ~/Library/LaunchAgents on this machine and is not removed by dropping it here. defaults.sh going away breaks `make defaults`, which is rewritten with the rest of the Makefile. No switch has run yet, so this is verified at build time only. Pre-switch `defaults read` baseline captured for diffing after the first activation.