systemd-tmpfiles now ensures ~/code and ~/code/work are owned by alex, since agenix previously created ~/code/work as root when the work secrets pointed there directly. Also drop the custom path= on work-gitconfig, work-github-token, and work-go-private so they use agenix's default secret path instead of living under ~/code/work.