flake: update inputs — nixpkgs 24.11 -> 26.05, sops-nix follows (operator 2026-08-01)

nixpkgs un-pinned from a frozen rev (50ab7937, 24.11, 2025-06-30) to the nixos-26.05
channel; sops-nix un-pinned to follow it. The old pins claimed to match the cc-ci
server "for ecosystem consistency", but this host runs agents/tmux/nginx/docker, not
recipe CI, so it need not track that server — and a frozen rev only accrues unpatched
CVEs. Built + activated: generation nixos-26.05.20260731.5b4f72e, kernel 6.6.94 ->
6.18.40 (reboot pending for the kernel). Pre-update files: /tmp/flake.{nix,lock}.pre-update.

Co-Authored-By: Claude <noreply@anthropic.com>

flake.nix

@@ -2,11 +2,14 @@
   description = "cc-ci-orchestrator — NixOS host for the cc-ci loops runtime (Builder/Adversary/Watchdog)";
 
   inputs = {
-    # Pinned to the same revision as the cc-ci server for ecosystem consistency.
-    nixpkgs.url = "github:NixOS/nixpkgs/50ab793786d9de88ee30ec4e4c24fb4236fc2674";
+    # Follow the current stable release channel (operator 2026-08-01), was a hard rev pin at
+    # nixpkgs 24.11 (50ab7937, 2025-06-30) kept "the same as the cc-ci server". This host runs
+    # agents/tmux/nginx/docker, not recipe CI, so it does not need to match that server — and a
+    # frozen rev only accrues unpatched CVEs. `nix flake update` now actually moves.
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
 
-    # Same pin as cc-ci server (buildGo125Module compatibility with nixpkgs 24.11).
-    sops-nix.url = "github:Mic92/sops-nix/77c423a03b9b2b79709ea2cb63336312e78b72e2";
+    # sops-nix follows nixpkgs below, so it no longer needs its own matching pin.
+    sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
   };