chore(auto): update flake inputs

[void-commander-brain-freeze]

CI repair report

What I changed

Nothing. nix run .#world -- check (nix flake check --impure) passes cleanly on
this branch: 58/58 outputs green, zero failures, and the warning set is identical
between the provided .ci-check.log and a fresh run I did myself. I could not find
anything in this repo's own .nix files that the input bump broke or that a
deprecation warning points back to — see below for what I checked and why each
warning is not something this repo can fix.

Warnings investigated, and why none needed a change here

• evaluation warning: stdenv.isLinux is deprecated, use stdenv.hostPlatform.isLinux instead
  and the matching stdenv.isDarwin warning. I grepped the whole tree (excluding
  /nix/store) for isLinux/isDarwin and this repo doesn't reference either
  attribute anywhere — flake/packages.nix already uses
  pkgs.stdenv.hostPlatform.isLinux. The warning fires from inside a transitive
  dependency (nixpkgs itself and/or one of the pinned flake inputs) that still
  reads the old attribute internally. There's no line in this repo to change; fixing
  it means patching nixpkgs or a third-party flake input, not this config.

• evaluation warning: The package 'devenv-test'/'devenv-up' is deprecated. Use the corresponding devenv <cmd> commands. These packages are auto-generated by
  devenv.flakeModule for every shell under devenv.shells (wired up in
  flake/devenv.nix) as a backward-compatible nix build target; the deprecation
  notice is devenv's own, not something this repo's shell definitions can silence
  without removing the packages. Both flake/buildkite-pipeline.nix and
  flake/github-actions.nix already exclude devenv-up from their CI build
  matrices, so nothing here actually builds it — it's inert noise.

• evaluation warning: You have not yet specified rekey.hostPubkey for your host test. / ...host nixos. These belong to the test and installer (nixos)
  nixosConfigurations, and the warning text says outright this is intentional
  ("so you can initially deploy your system to read the actual pubkey"). This is
  agenix-rekey secrets/key material behavior, unrelated to the input bump — per
  the constraints for this task I left it alone rather than touch anything in
  that area.

• warning: Using 'builtins.derivation' to create a derivation named 'options.json' ... — not referenced anywhere in this repo's .nix files
  either; it comes from options-doc generation inside one of the flake inputs
  (agenix-rekey or similar).

I compared the warning/pass-fail lines from the supplied .ci-check.log against a
fresh nix run .#world -- check run on this branch and they matched exactly, so
none of this is new fallout from the update that isn't already visible in the log.

Needs a human

Nothing new from this update. The four warnings above are pre-existing/upstream
noise, not regressions caused by this bump, and none of them have an actionable
fix inside this repository without either patching a third-party flake input
(devenv, nixpkgs) or touching secrets/key-material configuration, both of which
are out of scope for an automated pass.

🤖 Generated with Claude Code