docs: Add box installation procedure

Canonical, agent-agnostic procedure for bringing a new box into the
flake, from a booted installer through to a deployable system, plus a
thin Claude Code skill pointing at it -- same split as the nixpkgs
upgrade procedure.

Records the conventions that were not written down anywhere: sgdisk
plus an LVM PV for the nix and persist volumes, adopting the
installer's SSH host keys so secrets can be encrypted before first
boot, and taking whatever show-hw-config emits that the flake's own
modules do not already set.

Also notes in AGENTS.md that a changed recipient list should be
re-encrypted per file with ragenix --rekey-one; --rekey rewrites every
secret in secrets/ and buries the actual change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/README.md

@@ -27,6 +27,8 @@ Not every box fits this pattern, but **colony** and **home** are organised this
 - [`deployment.md`](deployment.md) — deploy-rs, devshell commands, secrets workflow, CI.
 - [`nixpkgs-upgrade.md`](nixpkgs-upgrade.md) — guided procedure for the periodic upgrade of the four
   nixpkgs channels and home-manager (fork rebase, stable bumps, input review).
+- [`install-box.md`](install-box.md) — guided procedure for installing a new box, from the booted
+  installer through partitioning, the box config, `do-install` and documentation.
 - [`reference/dns.md`](reference/dns.md) — generated forward and reverse DNS record reference.
 - [`reference/nixos-options.md`](reference/nixos-options.md) — generated per-option reference for
   the custom `my.*` NixOS modules.