chore(auto): update flake inputs

[void-commander-brain-freeze]

Flake update repair report

nix run .#world -- check (= nix flake check --impure) exits 0 on this
branch, and its warning set is byte-identical to the recorded .ci-check.log:
11 evaluation warnings and 11 Nix-level warnings, no errors.

Inputs bumped by this update: devenv, emacs-overlay, home-manager,
noctalia, nur, wezterm, zen-browser. nixpkgs was not bumped.

Changes

None. No .nix file in this repo needed a repair, and none of the surfaced
deprecations originate in a file this repo owns. Every warning was traced to a
specific line in a flake input (or to the update tooling, which is off-limits).
Details below, so the next person does not have to re-derive them.

All 11 host closures (alnitak, antares, cygnus, eris, icarus,
installer, jupiter, neptune, sagittarius, test, vega), both
homeConfigurations, and both darwinConfigurations (mini, VW2WRF4694)
evaluate to a .drv. No renamed-option warnings, no removed-option errors — so
nothing this repo sets was renamed or dropped by the home-manager bump.

Needs a human

1. Nushell filter is deprecated — misc/gh-release-update.nu

.ci-update.log reports filter was deprecated in 0.105.0 and will be removed in a future release, pointing at misc/gh-release-update.nu:10. The same
command appears twice more, at lines 26 and 36.

Not touched, on two counts:

• This is the update tooling. It decides which release URLs get pinned into
  flake.nix; a wrong edit still evaluates, still builds, still merges, and
  pins the wrong version on every host. A green check proves nothing here.
• The suggested replacement is not a rename. Line 10 filters a list of strings,
  where where/filter agree. Lines 26 and 36 are
  $releases | filter { |release| $release.draft == false and $release.prerelease == false } | first,
  which selects which version gets pinned. where parses a bare block as a
  row condition rather than as a closure, so the swap has to be checked against
  the installed Nushell, not assumed.

To fix, someone has to decide: keep filter until Nushell actually removes it,
or convert all three and verify against real GitHub API output that the same
release is still selected for victorialogs,
victoriametrics-logs-datasource-plugin and
victoriametrics-metrics-datasource-plugin.

Nushell comes from nixpkgs, which this update did not bump, so this warning is
not new — it was already there on the previous green run.

2. stdenv.isDarwin / stdenv.isLinux deprecated — all in flake inputs

4× isDarwin, 2× isLinux. This repo contains zero uses of stdenv.is*;
every site is already stdenv.hostPlatform.* (flake/packages.nix:57,61,65,
profiles/home-manager.nix:39, users/profiles/{nushell,rbw,emacs,wezterm}).
The warnings come from:

• wezterm — nix/flake.nix:63,72,83,154,160,259 (bumped by this update)
• devenv — src/modules/top-level.nix, src/modules/languages/* (bumped)
• zjstatus — flake.nix
• persway — devshell/modules/rust.nix
• nix-darwin — modules/programs/tmux.nix

Nothing local to change. Silencing these would mean patching or forking an
input, which is a behaviour change to someone else's package, not a repair.

3. devenv-up / devenv-test are deprecated packages

Emitted by inputs.devenv.flakeModule, imported at flake/devenv.nix:3. devenv
generates these two package attributes itself from devenv.shells; they are not
declared here. devenv was bumped by this update, so the warning is likely new.
Removing them is upstream's call — and they are still exported into
packages.x86_64-linux, so dropping the import to silence the warning would
take the dev shells with it.

4. rocksdb uses a nested list in buildInputs

Comes from inputs.tuwunel's package set (re-exported verbatim at
flake/packages.nix:112 as tuwunel-latest, used by modules/my-matrix.nix).
Deprecated as of Nixpkgs 26.05. Upstream fix.

5. builtins.derivation / options.json without proper context (11×)

home-manager's docs/default.nix:276 (pkgs.runCommand "options.json"),
referencing the nixpkgs source path. I diffed that block against the pre-update
home-manager rev 83b7606 — it is identical — so this is not a regression
from this update. Upstream fix.

6. rekey.hostPubkey not set for hosts test and nixos

Pre-existing and deliberate: agenix-rekey prints this on first deploy, and the
warning text itself says it is intentional. test and installer are the two
hosts that have never been deployed. This is key material and how it is
decrypted at activation — out of scope by policy, and setting a pubkey requires
actually deploying the host to read it.

7. Pre-existing, found while verifying: nix flake check --all-systems fails

Not part of what CI runs (world check omits incompatible systems), and not
caused by this update — but worth knowing:

• flake.nix:136 declares x86_64-darwin, and Nixpkgs 26.11 has dropped
  support for it. nixpkgs was not bumped here, so this was already true on the
  previous green run. There is no x86_64-darwin host —
  configurations/darwin/ contains only aarch64-darwin — so the fix is
  probably to drop it from the systems list, but that changes which outputs
  the flake advertises and should be a deliberate commit.
• packages.aarch64-darwin.noctalia (flake/packages.nix:54) fails with
  attribute 'aarch64-darwin' missing. I checked both the old (b67cc05) and
  new (966b01f) noctalia revs: both expose only aarch64-linux and
  x86_64-linux. So this is not a regression either. The neighbouring zwift
  and persway already carry an isLinux guard and a ## fix this one on darwin comment; noctalia does not.

Verification

• nix run .#world -- check — exit 0.
• nix eval .#darwinConfigurations.{mini,VW2WRF4694}.config.system.build.toplevel.drvPath
  — both produce a darwin-system-26.11 .drv.
• flake.lock and .cryo/ untouched.