flake: update inputs

nixpkgs moves from 2026-10-17 to 2026-11-01. Also updated: nix-amd-ai
and sops-nix.

Fallout handled in the same commit so every revision builds:
- tlp-profile-switcher was dropped from nixpkgs (upstream declares only
  GNOME 48) and aider-chat's posthog dependency is broken on Python
  3.14; take both from the previous nixpkgs until they evaluate again.
- NSS 3.131.1 removed "emSign ECC Root CA - G3", and a blacklist entry
  for a missing root fails the cacert build; drop it.
- A cached firefox-devedition is back in nixpkgs, so remove the
  2026-07-05 pin.

Assisted-by: Claude:opus-5-5

modules/packages.nix

@@ -1,6 +1,20 @@
 # System packages configuration
 { config, pkgs, lib, inputs, ... }:
 
+let
+  # nixpkgs 2026-10-17 (previous lock) for packages the 2026-11-01 bump broke:
+  # - tlp-profile-switcher: upstream declares only GNOME 48, so nixpkgs dropped
+  #   it; it runs on 50 here because version validation is disabled.
+  # - aider-chat: its posthog dependency is marked broken (python 3.14).
+  # Drop each entry once it evaluates on the current nixpkgs again.
+  pkgsPrev = import (builtins.fetchTree {
+    type = "github";
+    owner = "NixOS";
+    repo = "nixpkgs";
+    rev = "09063bd1f2b36fd9fd793c36dfade7bd40a93dfc";
+    narHash = "sha256-Mh0PUaIv4nFY+8wAGonaEh8iBzwsmdNlwjVHmFg1Biw=";
+  }) { inherit (pkgs.stdenv.hostPlatform) system; };
+in
 {
   # Allow unfree packages
   nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
@@ -113,7 +127,7 @@
     # terragrunt    # broken in nixpkgs
     gh
     forgejo-cli     # fj, for Forgejo (dev.narayana.im, dev.another.im)
-    aider-chat      # AI pair programming CLI (OpenRouter via ~/.local/bin/aider)
+    pkgsPrev.aider-chat  # AI pair programming CLI (OpenRouter via ~/.local/bin/aider)
 
     # WWAN modem tools
     libmbim
@@ -143,7 +157,7 @@
     xray
 
     # GNOME extensions
-    gnomeExtensions.tlp-profile-switcher
+    pkgsPrev.gnomeExtensions.tlp-profile-switcher
     gnomeExtensions.appindicator  # tray icons (StatusNotifierItem): another.im's "Stay connected when closed"
   ];