Efficient NixOS Remote Deploys with Selective Closure Copying

Remote NixOS deploys get dramatically faster when the target host fetches public dependencies from its own substituters and you only push the private bits. The key is `--use-substitutes` and the trusted-user detail most guides skip.