flake: bump nixpkgs + sops-nix (2026-08-03)

nixpkgs: 50ab793 -> 531670d (nixos-26.05, was nixos-24.11 EOL)
sops-nix: 77c423a -> f140661 (master, buildGo125Module now builds on 26.05)

3-release channel jump (24.11 -> 25.05 -> 25.11 -> 26.05) to match the
orchestrator host and get CVE patches. 24.11 was EOL (2025-06-30).

Notable 26.05 changes reviewed: systemd Stage 1 boot (default, no config
change needed), dbus-broker default, bash nixos-rebuild removed (Python
rewrite mandatory; git present on host), MySQL 8.0 removed (not used as a
NixOS module). No system.rebuild/fileSystems/boot.initrd options in the
host config, so no config edits required.

flake.nix

@@ -2,13 +2,17 @@
   description = "cc-ci — Co-op Cloud recipe CI server (NixOS)";
 
   inputs = {
-    # Pinned to the exact revision cc-ci already runs, so the first rebuild from
-    # this repo is a true no-op-then-base (M0). Bump deliberately, not drift.
-    nixpkgs.url = "github:NixOS/nixpkgs/50ab793786d9de88ee30ec4e4c24fb4236fc2674";
+    # Pinned to the nixos-26.05 channel tip (2026-08-03). Matches the orchestrator host's
+    # channel so both boxes share a nixpkgs and CVEs get patched. Bump deliberately, not drift.
+    # Previous pin: 50ab793 (nixos-24.11, 2025-06-30) — 24.11 was EOL; this is a 3-release jump
+    # (24.11 -> 25.05 -> 25.11 -> 26.05). Notable 26.05 changes: systemd Stage 1 boot by default,
+    # dbus-broker default, bash nixos-rebuild removed (Python rewrite mandatory), MySQL 8.0 removed.
+    nixpkgs.url = "github:NixOS/nixpkgs/531670d871c0e29724a02f3cbcac170adc65b58c";
 
-    # Pinned to a commit that still uses plain `buildGoModule` — sops-nix master moved to
-    # `buildGo125Module` (Go 1.25), which our pinned nixpkgs 24.11 (2025-06-30) does not have.
-    sops-nix.url = "github:Mic92/sops-nix/77c423a03b9b2b79709ea2cb63336312e78b72e2";
+    # sops-nix master (buildGo125Module / Go 1.25), which builds against nixpkgs 26.05.
+    # Previous pin (77c423a) held back to plain buildGoModule for nixpkgs 24.11 compat — no
+    # longer needed on 26.05.
+    sops-nix.url = "github:Mic92/sops-nix/f1406619a3884cd5c47992a70b8b35c9c0fcb4c9";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
   };