chore(auto): update flake inputs

[void-commander-brain-freeze]

CI repair report

What I changed

Nothing. nix run .#world -- check (as captured in .ci-check.log, and
re-verified by re-running it) evaluates every nixosConfigurations,
homeConfigurations, devShells and packages output for
x86_64-linux successfully (all ✅, no ❌, no eval errors, no
assertion failures). This flake-input bump is a small, same-week
nixpkgs/nixpkgs-stable bump (about 8 hours apart) plus routine bumps
of devenv, fenix, emacs-overlay, helix, nixos-hardware,
noctalia-shell, NUR, rust-overlay, wezterm, zen-browser-flake
and claude-code-nix — see flake.lock. I searched the repo for every
option/attribute named in the warnings below (stdenv.isLinux,
stdenv.isDarwin, devenv-up, devenv-test, options.json,
rekey.hostPubkey) and none of them are set or referenced in this
repo's own .nix files, so there is no local option to rename or pin.

Deprecation warnings surfaced by the update

All four evaluation warnings in .ci-check.log trace to code inside
third-party flake inputs, not to any option this repo sets:

• stdenv.isLinux is deprecated, use stdenv.hostPlatform.isLinux instead / the matching stdenv.isDarwin warning — emitted while
  evaluating the niri package graph (pulled in via
  users/profiles/niri.nix and friends), from inside a transitive
  dependency's own package expression (fetched via nix-filter, not
  vendored in this repo). Grepped the whole tree for
  stdenv.isLinux/stdenv.isDarwin: no matches outside the Nix store.
  Nothing here to rename.
• The package 'devenv-up' is deprecated. Use the corresponding \devenv ` commands.and the matchingdevenv-testwarning — these two packages are generated automatically byinputs.devenv.flakeModule(wired up inflake/devenv.nix) for every devenv shell under devenv/. The deprecation notice is baked into devenv's own flake module output, not into anything this repo configures; we never reference devenv-up/devenv-testby name ourselves,nix flake check` just evaluates every package the module
  exposes.
• Using 'builtins.derivation' to create a derivation named 'options.json' ... without a proper context — not associated with
  any file in this repo (no options.json, nixos-render-docs, or
  buildOptionsJSON reference anywhere in the tree); it comes from an
  options-doc derivation inside one of the flake inputs.

None of these map to a NixOS/home-manager/nix-darwin module option that
this repo sets, so there's no rename-with-same-effect to apply, and per
the "boring fix" rule there's nothing safe to pin either — pinning
would mean patching someone else's flake input, which is a bigger,
riskier change than the warning justifies.

The two evaluation warning: You have not yet specified rekey.hostPubkey for your host test/...host nixos messages are
agenix-rekey's normal first-deploy notice for the test and
installer hosts (both intentionally have no hostPubkey set yet, per
the warning's own text: "This is intentional so you can initially
deploy your system to read the actual pubkey"). This is pre-existing
behaviour, not something the flake update changed, and touches secrets
handling, so it's covered by "Needs a human" below regardless.

Needs a human

• rekey.hostPubkey unset for test and installer hosts.
  Pre-existing, secrets-related, and intentional per the warning text —
  not something to "fix" without knowing whether those hosts are meant
  to stay in first-deploy state. Flagging per the "secrets/key material"
  exclusion rather than changing anything.
• Nothing else — no build failures, no option renames, no assertion
  changes were introduced by this input bump.

Verified with nix run .#world -- check.