treefmt: apply prettier

Pure `nix fmt` output from the commit before this one — no hand edits.
203 files: 52 md, 42 tsx, 32 js, 32 css, 21 ts, 13 html, 8 json, 3 mjs.

Reproduce with `nix develop -c nix fmt` on the parent commit; the result
should be byte-identical to this tree.

None of the 13 `.prettierignore` entries appears here — verified by
intersecting the changed-file list against the ignore file, with a
control proving the intersection finds a match when one exists.

docs/process/gotchas.md

@@ -78,8 +78,8 @@ existing containers can't be started.
 ### `RestrictAddressFamilies` fails as "Address family not supported by protocol"
 
 A unit whose `RestrictAddressFamilies` omits a family gets `EAFNOSUPPORT`
-(errno 97) back from `socket()`. Clients surface that as *"tcp open error:
-Address family not supported by protocol"* — the message names the
+(errno 97) back from `socket()`. Clients surface that as _"tcp open error:
+Address family not supported by protocol"_ — the message names the
 **protocol** and never the **sandbox**, so it reads like a dead network, a
 missing route, or an IPv6 problem.
 
@@ -98,7 +98,7 @@ re-checks it when the program changes.** A unit that only served a unix
 socket when it was written is correct at `[ "AF_UNIX" ]` and silently wrong
 the day someone adds an HTTP client. Check the unit in the same commit as
 the client — and when narrowing it, prefer a test that derives the required
-families from the code (which fails on the *next* client too) over one that
+families from the code (which fails on the _next_ client too) over one that
 asserts today's list.
 
 ### `register_agent` is idempotent
@@ -120,7 +120,7 @@ operator's host-level `allowUnfree` does **not** propagate in.
 Operators don't need to set anything on their side.
 
 That same isolation is why an agent can't pick a claude out of a
-*different* nixpkgs by itself: a container only ever sees the one
+_different_ nixpkgs by itself: a container only ever sees the one
 nixpkgs the meta flake injects, so an `agent.nix` naming the host's
 `nixpkgs-unstable` has nothing to name. A release channel can trail
 unstable by weeks on this package, which is what
@@ -140,7 +140,7 @@ an input only because a docs tree has no runtime dependencies.
 
 The `storePath` trap is worth spelling out, because it is not confined
 to options the operator writes: **any** option of type `package` fed a
-store-path *string* coerces through `lib.toDerivation`, i.e.
+store-path _string_ coerces through `lib.toDerivation`, i.e.
 `builtins.storePath`. `environment.systemPackages` and
 `systemd.services.<name>.path` both do it (the latter takes plain
 strings like `/run/wrappers` happily, but anything under

docs/process/pr-review-gate.md

@@ -8,7 +8,7 @@ human review that already happened.
 
 Whether a PR can merge, and what counts toward "can", is configured
 per repo in its branch-protection settings — not a fact true of every
-hive or every repo. The pieces a repo *can* require:
+hive or every repo. The pieces a repo _can_ require:
 
 - **CI is green** — the repo's required status checks pass on the
   PR's current head commit, if the repo requires any.
@@ -40,8 +40,8 @@ independently.
 
 Auto-merge isn't "no human ever looked at this." Whoever arms it has
 already judged the PR sound at a coarse level — the signal it sends is
-roughly *"apart from maybe minor tweaks a reviewer can still catch,
-I think this is fine."* That's the human-in-the-loop step, and it
+roughly _"apart from maybe minor tweaks a reviewer can still catch,
+I think this is fine."_ That's the human-in-the-loop step, and it
 already happened. No large changes are expected to surface after
 that point — a reviewer's job past that point is to flag it if one
 does, not to assume none ever will.