unprivileged updating

[KiaraGrouwstra]

so far, nixos-anywhere's terraform module deploys updates presuming:

• ssh access
• root/sudo permissions
• nixos with nix
• builds handled by the machine invoking terraform (same for install) then pushed to the target machine, whereas the nixos-anywhere cli also offers say --build-on-remote

now, an alternate way to deploy new configurations seems to poke* servers to pull them from a cache.
this approach seems taken by nixless-agent, whose author has commented on usage with nixos-anywhere.

it would be nice to see such an approach supported in nixos-anywhere's nixos-rebuild TF step as well, as an alternative to the SSH+privilege+push approach currently used.

* this part involves security considerations as well