refactor: unify socketWaitScript interface, reorder scripts.nix sections

Replace the dual mkSocketWaitScript/socketWaitScript pair in vm-config.nix
with a single socketWaitScript taking an onTimeout argument. Add section
headers to scripts.nix to distinguish VM launcher scripts from proxy and
user-facing scripts.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

modules/lib/vm-config.nix

@@ -322,7 +322,7 @@ let
 
   # Wait for vhost-user backend sockets
   # onTimeout: extra shell commands to run before exit on timeout (e.g. "kill $CH_PID")
-  mkSocketWaitScript =
+  socketWaitScript =
     onTimeout:
     lib.optionalString (vhostUserSockets != [ ]) ''
       # Wait for vhost-user backend sockets (up to 30s)
@@ -339,7 +339,6 @@ let
         fi
       done
     '';
-  socketWaitScript = mkSocketWaitScript "";
 
   # ── crosvm-specific helpers (computed here to keep mkCrosvmVmScript thin) ──
 
@@ -524,7 +523,6 @@ in
     vmPciDevicePaths
     allKernelParams
     iommuValidationScript
-    mkSocketWaitScript
     socketWaitScript
     ;
 

modules/scripts.nix

@@ -27,6 +27,8 @@ let
 
   vms = assignVmIds cfg.nixosVms;
 
+  # ── VM launcher scripts ──────────────────────────────────────────────────
+
   # Default block device options applied to all disks (crosvm only)
   defaultBlockOpts = {
     packed-queue = true; # More efficient, better cache locality than split virtqueues
@@ -72,7 +74,7 @@ let
       # Clean up stale socket
       rm -f /run/vmsilo/${vm.name}/crosvm-control.socket
 
-      ${c.socketWaitScript}
+      ${c.socketWaitScript ""}
 
       exec ${cfg._internal.crosvm}/bin/crosvm \
         --log-level=${effectiveLogLevel} \
@@ -171,7 +173,7 @@ let
         exit 1
       fi
 
-      ${c.mkSocketWaitScript "kill $CH_PID 2>/dev/null || true"}
+      ${c.socketWaitScript "kill $CH_PID 2>/dev/null || true"}
 
       # Step 2: Create VM configuration
       ${c.ch.remote} \
@@ -216,6 +218,8 @@ let
   mkVmScript =
     vm: if vm.hypervisor == "crosvm" then mkCrosvmVmScript vm else mkCloudHypervisorVmScript vm;
 
+  # ── Proxy and user-facing scripts ────────────────────────────────────────
+
   # vsock proxy for cloud-hypervisor: connect via unix socket + CONNECT handshake
   mkChVsockConnectScript =
     vmName: port: