feat(machines): add tart-agent-sandbox VM config

NixOS configuration for running LLM agents in isolated Tart VMs on
Apple Silicon. Includes:
- Headless server setup with SSH access
- Agent user with passwordless sudo
- Docker support
- Dev tools for cloning large repos
- Git config optimized for large repositories

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

flake.nix

@@ -214,6 +214,14 @@
       ];
     };
 
+    # Agent sandbox VM for Tart (aarch64-linux on Apple Silicon)
+    nixosConfigurations.tart-agent-sandbox = nixpkgs.lib.nixosSystem rec {
+      system = "aarch64-linux";
+      modules = nixosModules ++ [
+        ./machines/tart-agent-sandbox/configuration.nix
+      ];
+    };
+
     # Darwin/macOS configurations
     darwinConfigurations."blkfv4yf49kt7" = inputs.nix-darwin.lib.darwinSystem rec {
       system = "aarch64-darwin";