chore(auto): update flake inputs

[void-commander-brain-freeze]

Flake update repair report

No configuration changes were made. The update did not break anything in
this repository, and none of the deprecation warnings in .ci-check.log
originate from code in this repository.

nix run .#world -- check exits 0 on this branch (re-run from a clean tree,
not just read from the log). nix run .#world -- lint also passes.

What I changed

Nothing. There is no diff beyond the flake.lock the updater already wrote.

Why nothing needed changing

nix flake update bumped cachix, claude-code, devenv, emacs-overlay
(+ its nixpkgs-stable), fenix (+ rust-analyzer-src), flake-parts
(+ nixpkgs-lib), home-manager, noctalia, nur, rust-overlay and
zen-browser (+ its vendored home-manager).

nixpkgs itself was not bumped, so no NixOS option renames or removals
are in play in this update.

To rule out the failure mode that matters here — a renamed option silently
dropped, so the build stays green while the machine loses a setting — I
evaluated config.warnings and config.assertions directly for every
configuration this flake exposes, rather than relying on the check log:

• 10 nixosConfigurations (alnitak, antares, cygnus, eris, icarus, installer,
  jupiter, neptune, sagittarius, test, vega)
• 2 darwinConfigurations (mini, VW2WRF4694)
• 2 homeConfigurations (john@devbox, jeriksson@workstation-7jjg6)

Result: zero failed assertions, and zero warnings anywhere, except the two
pre-existing agenix-rekey rekey.hostPubkey notices on test and installer
(see below). No has been renamed to / has been removed module warning is
produced by any host. Nothing was silently dropped.

Where each deprecation warning in .ci-check.log actually comes from

Every one of them is emitted by a flake input's own Nix code, not by this
repo, so there is no edit here that would silence them:

• The package 'devenv-test' is deprecated / 'devenv-up' is deprecated
  — injected unconditionally by devenv's own flake-module
  (devenv/flake-module.nix, the deprecate wrapper around
  packages.devenv-up / packages.devenv-test). This repo does not declare
  those packages; flake/devenv.nix only sets devenv.shells. The only way
  to remove them is to stop importing inputs.devenv.flakeModule, which
  would delete the dev shells. Upstream's job.

• stdenv.isDarwin is deprecated / stdenv.isLinux is deprecated
  — comes from the persway input (devshell/modules/rust.nix, two uses of
  pkgs.stdenv.isDarwin) and the zjstatus input (flake.nix:51). This
  repo already uses pkgs.stdenv.hostPlatform.isDarwin / .isLinux
  everywhere (9 call sites across flake/packages.nix, profiles/,
  users/profiles/); there is nothing left here to migrate.

• Dependency of package 'rocksdb' uses a nested list in attribute 'buildInputs' — from the tuwunel input's rocksdb overlay, surfaced by
  the new nested-list deprecation in nixpkgs'
  pkgs/stdenv/generic/make-derivation.nix. Not reachable from this repo,
  which only does tuwunel-latest = inputs.tuwunel.packages.${system}.default.

• Using 'builtins.derivation' to create a derivation named 'options.json' ... without a proper context — a Nix-level warning about nixpkgs'
  nixos/lib/make-options-doc/default.nix, triggered by the NixOS manual
  being built for each host. Comes from nixpkgs + Nix, not from this
  configuration.

• GC Warning: Repeated allocation of very large block — evaluator memory
  noise, not a configuration issue.

Per constraint 4 ("prefer the boring fix ... pin it"), the boring fix for all
of these is to do nothing and let the inputs catch up: pinning any of them to
an older revision would undo the update, and patching vendored input code
would be neither small nor local.

Needs a human

1. misc/gh-release-update.nu — deprecated nushell filter

.ci-update.log shows a parser deprecation from the updater itself:

! Command deprecated.
  ,-[misc/gh-release-update.nu:10:5]
  filter { |line| $line | str contains "gh-release-update" }
  `-- filter was deprecated in 0.105.0 and will be removed in a future release.
help: `where` command can be used instead

Three call sites use filter with a closure: line 10 (selecting the flake
inputs tagged # gh-release-update) and lines 26 and 36 (selecting the first
non-draft, non-prerelease GitHub release).

I did not change this, because it is the update tooling: it is what decides
which release URL gets pinned into flake.nix, and a wrong choice there
still evaluates, still builds, still merges, and pins the wrong version on
every host. A passing build proves nothing about it.

What I would have changed, for a human to review: filter { ... } →
where { ... } at lines 10, 26 and 36. The reason this is not purely
mechanical is lines 26/36 — where and filter are not interchangeable in
the general case, because where also has a row-condition/short-form parsing
mode (where draft == false), and the closure passed there is what selects
the release whose name becomes the new pinned version. Getting that
selection subtly wrong (e.g. matching a prerelease, or a differently-named
release) silently downgrades or upgrades victorialogs and the two
VictoriaMetrics Grafana datasource plugins on every host that runs them.
That needs someone who can run the updater against the real GitHub API and
compare the resulting URLs before and after.

Note: this is currently only a warning; the script still works — this run
correctly resolved VictoriaLogs 1.51.1, victorialogs-datasource 0.31.0 and
victoriametrics-datasource 0.25.2, and made no changes to flake.nix. It
will break when nushell removes filter.

2. rekey.hostPubkey not set for hosts test and installer

You have not yet specified rekey.hostPubkey for your host test / nixos.
All secrets for this host will be rekeyed with a dummy key, resulting in an
activation failure.

Left alone, and I believe deliberately so: every real host
(alnitak, antares, cygnus, eris, icarus, jupiter, neptune,
sagittarius, vega, both darwin hosts, both home configs) sets
hostPubkey; only the scratch test config and the installer image do not,
and agenix-rekey's own message says this state is intentional until the host
has been deployed once and its pubkey read back.

This is pre-existing and not caused by the update — nothing but flake.lock
changed in this branch. It is also secrets/key-material territory, so it is
explicitly a human decision: fixing it means generating or reading a host key
and committing the public half, which changes how secrets are decrypted at
activation.

3. Silent upstream default changes (limit of what I verified)

I verified there are no renamed, removed or dropped options, and no failed
assertions, across all 14 configurations. What that does not cover is an
input changing a module's default value without a rename or a warning —
home-manager moved a day (f772b7f → ead131e), as did noctalia and
zen-browser, and all three feed into host configuration. No tooling in this
repo catches that class of change, and I could not diff those trees from this
sandbox (no network access for the tools available to me).

I did not try to guess and pin defaults preemptively: adopting or freezing a
new default is exactly the "decision for a person" the constraints reserve.
If a reviewer wants that closed off, the thing to do is diff
nix-community/home-manager f772b7f...ead131e for changes under modules/
that touch options this repo sets.