pinwheel: fix ~/code/work ownership, drop custom secret paths

systemd-tmpfiles now ensures ~/code and ~/code/work are owned by
alex, since agenix previously created ~/code/work as root when the
work secrets pointed there directly.

Also drop the custom path= on work-gitconfig, work-github-token, and
work-go-private so they use agenix's default secret path instead of
living under ~/code/work.

hosts/pinwheel/modules/work/default.nix

@@ -116,6 +116,13 @@ EOF
     };
   };
 
+  # Ensure ~/code/work is owned by alex; it was previously created as root by
+  # agenix when secrets had a custom path there.
+  systemd.tmpfiles.rules = [
+    "d /home/alex/code 0755 alex users -"
+    "d /home/alex/code/work 0755 alex users -"
+  ];
+
   # Needed for `copilot`
   programs.nix-ld.enable = true;
   programs.nix-ld.libraries = [
@@ -138,21 +145,18 @@ EOF
   age.secrets = {
     "work-gitconfig" = lib.mkIf gitEnabled {
       file = ../../../../secrets/pinwheel/work-gitconfig.age;
-      path = "/home/alex/code/work/.work-gitconfig";
       owner = "alex";
       group = "users";
     };
 
     "work-github-token" = lib.mkIf gitEnabled {
       file = ../../../../secrets/pinwheel/work-github-token.age;
-      path = "/home/alex/code/work/.work-github-token";
       owner = "alex";
       group = "users";
     };
 
     "work-go-private" = lib.mkIf goEnabled {
       file = ../../../../secrets/pinwheel/work-go-private.age;
-      path = "/home/alex/code/work/.work-go-private";
       owner = "alex";
       group = "users";
     };