Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@doc/build.go`:
- Around line 293-296: The early "return" when defaultValue == nil causes the
function to exit before writing deprecated notices; instead, stop returning and
only skip rendering the default value so the deprecated block still runs.
Replace the "return" in the defaultValue == nil check with logic that continues
processing (e.g., "continue" if inside a loop) or otherwise skips outputting the
default value but allows the subsequent deprecated rendering code (the block
that writes the deprecation notice around lines where the deprecated message is
emitted) to execute; reference the defaultValue variable and the surrounding
deprecated-rendering code to find and update the flow.

In `@internal/settings/settings.go`:
- Around line 94-99: The example for ssh.private_key_cmd uses a bare slice
(Example = []string{"sh", "-c", "rbw get $NIXOS_CLI_SSH_HOST"}) which causes
toml.Marshal to panic; update the Example value (the DescriptionEntry.Example
usage) to be a map or struct wrapper (e.g. map[string]any{"command":
[]string{...}}) or a raw string so the TOML encoder won't attempt to emit a
root-level slice, and also correct the typo "internet accesss" to "internet
access" in the corresponding description text.

---

Outside diff comments:
In `@internal/settings/settings.go`:
- Line 177: Fix the typo in the command/flag description: locate the Short
string that currently reads "Bind-mount host 'resolv.conf' inside chroot for
internet accesss" and change "accesss" to "access" so the Short description
reads "Bind-mount host 'resolv.conf' inside chroot for internet access"; update
the Short field where it is defined (the command's Short property in
settings.go).

---

Nitpick comments:
In `@internal/settings/errors.go`:
- Around line 16-24: DeprecatedSettingError.Error() currently returns a
multi-line string which can surprise callers expecting a single-line error;
change Error() to return a single-line representation (e.g., combine e.Field,
DeprecatedDocString and e.Alternative into one line separated by punctuation
like " - hint: " or parentheses) and add a new method (e.g., DetailedMessage()
or UserMessage()) that returns the multi-line, user-facing text for CLI output;
update references to use DetailedMessage() where multi-line hints are intended
and keep Error() as the concise single-line string to satisfy
fmt.Errorf/loggers.

In `@internal/settings/settings.go`:
- Around line 199-203: Normalize the deprecation message for the "no_confirm"
setting to match the CLI error alternative: update the Deprecated field in the
"no_confirm" entry so it reads exactly like DeprecatedSettingError.Alternative
(use "set `confirmation.always` to `true` instead" with the same casing and
punctuation), ensuring both the Deprecated string in the map and the Alternative
value used by DeprecatedSettingError are identical.