flake: update inputs

nixpkgs moves from 2026-10-17 to 2026-11-01. Also updated: nix-amd-ai
and sops-nix.

Fallout handled in the same commit so every revision builds:
- tlp-profile-switcher was dropped from nixpkgs (upstream declares only
  GNOME 48) and aider-chat's posthog dependency is broken on Python
  3.14; take both from the previous nixpkgs until they evaluate again.
- NSS 3.131.1 removed "emSign ECC Root CA - G3", and a blacklist entry
  for a missing root fails the cacert build; drop it.
- A cached firefox-devedition is back in nixpkgs, so remove the
  2026-07-05 pin.

Assisted-by: Claude:opus-5-5

modules/packages.nix

@@ -1,6 +1,20 @@
 # System packages configuration
 { config, pkgs, lib, inputs, ... }:
 
+let
+  # nixpkgs 2026-10-17 (previous lock) for packages the 2026-11-01 bump broke:
+  # - tlp-profile-switcher: upstream declares only GNOME 48, so nixpkgs dropped
+  #   it; it runs on 50 here because version validation is disabled.
+  # - aider-chat: its posthog dependency is marked broken (python 3.14).
+  # Drop each entry once it evaluates on the current nixpkgs again.
+  pkgsPrev = import (builtins.fetchTree {
+    type = "github";
+    owner = "NixOS";
+    repo = "nixpkgs";
+    rev = "09063bd1f2b36fd9fd793c36dfade7bd40a93dfc";
+    narHash = "sha256-Mh0PUaIv4nFY+8wAGonaEh8iBzwsmdNlwjVHmFg1Biw=";
+  }) { inherit (pkgs.stdenv.hostPlatform) system; };
+in
 {
   # Allow unfree packages
   nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
@@ -113,7 +127,7 @@
     # terragrunt    # broken in nixpkgs
     gh
     forgejo-cli     # fj, for Forgejo (dev.narayana.im, dev.another.im)
-    aider-chat      # AI pair programming CLI (OpenRouter via ~/.local/bin/aider)
+    pkgsPrev.aider-chat  # AI pair programming CLI (OpenRouter via ~/.local/bin/aider)
 
     # WWAN modem tools
     libmbim
@@ -143,7 +157,7 @@
     xray
 
     # GNOME extensions
-    gnomeExtensions.tlp-profile-switcher
+    pkgsPrev.gnomeExtensions.tlp-profile-switcher
     gnomeExtensions.appindicator  # tray icons (StatusNotifierItem): another.im's "Stay connected when closed"
   ];
 

modules/security.nix

@@ -48,7 +48,8 @@
   # Drop these roots from the system CA bundle (names must match bundle labels)
   security.pki.caCertificateBlacklist = [
     "Comodo AAA Services root"
-    "emSign ECC Root CA - G3"
+    # "emSign ECC Root CA - G3": removed upstream in NSS 3.131.1; a stale
+    # entry fails the cacert build.
   ];
 
   # USBGuard configuration

modules/xray.nix

@@ -1,18 +1,6 @@
 # Xray VLESS+Reality (PQ encryption) with sing-box TUN
 { config, pkgs, lib, ... }:
 
-let
-  # Pin Firefox DevEdition to nixpkgs 2026-07-05: 152.0b8 is cached there,
-  # whereas the current nixpkgs ships the same version uncached with a broken
-  # source build (webrender COUNT identifier error). Drop this pin once a
-  # newer, cached devedition lands upstream.
-  pkgsFirefox = import (builtins.fetchTree {
-    type = "github";
-    owner = "NixOS";
-    repo = "nixpkgs";
-    rev = "d407951447dcd00442e97087bf374aad70c04cea";
-  }) { inherit (pkgs.stdenv.hostPlatform) system; config.allowUnfree = true; };
-in
 {
   # Config is sops-encrypted; decrypted to /run/secrets at activation and
   # handed to the DynamicUser service via LoadCredential (stays root-only 0400).
@@ -143,7 +131,7 @@ in
   # Firefox dev edition
   programs.firefox = {
     enable = true;
-    package = pkgsFirefox.firefox-devedition;
+    package = pkgs.firefox-devedition;
     policies = {
       # Estonian ID: load OpenSC PKCS#11 for TLS client-cert auth,
       # and force-install the Web eID extension (talks to web-eid-app host).