chore(deps): update dependencies

[emaiax]

Automated nix flake update.

Flake lock file updates:

• Updated input 'home-manager':
    'github:nix-community/home-manager/79e6082586b3680ff32c8e75127545058f074fa4?narHash=sha256-iMO/Ypany7DPXD6D7sQgH7METtEUihnOvdb%2BA9ehn8k%3D' (2026-07-10)
  → 'github:nix-community/home-manager/39411a8e12a5526d992e65bc7e3dc9a4414d6713?narHash=sha256-iZrxHToDJWnvt%2B5LGAtvuQMTy1NZYlNEKbKaVtBJNcc%3D' (2026-07-18)
• Updated input 'nix-darwin':
    'github:LnL7/nix-darwin/d5bd9cd77aea4c0a8f49e7fd85545671a208ed15?narHash=sha256-AAbexQvDoK%2B6GFJdhY6kqjA%2B6ECKRkidgWxkn4gMwAA%3D' (2026-07-07)
  → 'github:LnL7/nix-darwin/b4cccbd4bc299c1f71ae185b79c3cf99aa82805c?narHash=sha256-EP9b9b%2BOXDxHBPefFwMYCIaLq0fn3UkmrbfzbLUT7kQ%3D' (2026-07-18)
• Updated input 'nix-homebrew':
    'github:zhaofengli/nix-homebrew/de7953a08ed4bb9245be043e468561c17b89130d?narHash=sha256-ORqLAo/hoJdsZC7UPAuEHev6S0%2BXIqKEC7vjo5prz1k%3D' (2026-06-13)
  → 'github:zhaofengli/nix-homebrew/842eeb863ecca0eeb463f7a814cdc51e1d925776?narHash=sha256-I/B6YoRLImHEqNWh8bs%2BtPjEDeteACeFhcLyoSMo1GE%3D' (2026-07-15)
• Updated input 'nix-homebrew/brew-src':
    'github:Homebrew/brew/109191be4988470b51a60a5ef1998520aa24c01b?narHash=sha256-w4ZTuOnhYiDxjaynrMTASzp802QblBWmo3wpB8wVN4Y%3D' (2026-06-12)
  → 'github:Homebrew/brew/6bd951d96e7ebc54787799dba77bfb26ec956c4c?narHash=sha256-7KnV7rTlMpys%2B2J%2BTFVxUDDyKPLXFs4wIMtckMC72VM%3D' (2026-07-14)
• Updated input 'nix-vscode-extensions':
    'github:nix-community/nix-vscode-extensions/6cb9c541989996f3481ce747865c9dbe37be719e?narHash=sha256-KwlfSN9Py11iYlG56AsjmhJfCtfzPlS2YgyHJ1cIZ80%3D' (2026-07-10)
  → 'github:nix-community/nix-vscode-extensions/472a3e862c76c64ac3ad75a24d332cb5cdd5f1bb?narHash=sha256-EGkegdTz2n6ESyih8s3dUuPyJQWlYfPp7U41J05g8PY%3D' (2026-07-18)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/05988b07fb05cbcb50be6bce197b4b5f75b5e61b?narHash=sha256-3S92fSuv32mjJz2Qb2F4405c21J55F4NIphz5K6hxco%3D' (2026-07-08)
  → 'github:NixOS/nixpkgs/20535e48e12c86043b577b8518234ff5dbb26957?narHash=sha256-CdItYNdYUlm7NxqMVyQKqT2IxTwvapiPuRLWOyHTrbY%3D' (2026-07-18)

[emaiax]

CI failure root cause

build (dudupro, macos-15) fails with error: Cannot build '.../users-groups.json.drv'. Reason: platform mismatch. Required system: 'aarch64-linux'. Current system: 'aarch64-darwin'.

The build job runs nix build .#darwinConfigurations.dudupro.system, which transitively builds nix.linux-builder's aarch64-linux VM image (modules/core/nix-daemon.nix) as part of the system closure: nixos-system-nixos-26.11 → nixos-vm → create-builder → linux-builder-start → the darwin system's launchd plist. The GitHub-hosted macOS runner has no way to build aarch64-linux derivations locally (macOS can't run Linux binaries, and there's no remote/distributed builder registered on an ephemeral runner) — every store path in that VM's closure must come pre-built from cache.nixos.org or the job fails.

Confirmed this was never about the linux-builder config itself (already-merged #91 is unrelated — the same error reproduces both before and after that merge): the last green build run (2026-07-14, af357f6) shows users-groups.json and nixos-system-nixos-26.11 being copied from cache.nixos.org, never built. The failing runs (2026-07-16 and this PR) hit the exact same derivation with a genuine local-build attempt instead — i.e. cache.nixos.org didn't have that VM closure substituted for the newly-bumped nixpkgs-unstable revision. Since flake.lock is the only diff in this PR, that nixpkgs bump is what triggers it.

This is a structural gap: enabling nix.linux-builder on a host whose config CI actually nix builds makes CI depend on cache-fetch timing for something CI can never really validate (it can't build or run that VM either way).

Fix pushed: a1dec46 adds checks.aarch64-darwin.build-dudupro in flake.nix — the same dudupro config with nix.linux-builder.enable forced off — and points the build job at it instead of darwinConfigurations.dudupro.system. darwinConfigurations (used by just switch/just build on real hardware) is untouched.

[emaiax]

Second failure, after the linux-builder fix: watchexec / cctools SIGTRAP

Once the linux-builder issue above was fixed, CI hit a different, unrelated failure building `watchexec`:

```
error: linking with `.../clang-wrapper-21.1.8/bin/cc` failed: exit status: 1
.../cctools-binutils-darwin-wrapper-1010.6/bin/ld: line 292: ... Trace/BPT trap: 5 .../cctools-binutils-darwin-1010.6/bin/ld "@$responseFile"
clang: error: linker command failed with exit code 133
```

This is a known, already-reported nixpkgs regression: nixpkgs#543288 ("Build failure: watchexec (aarch64-darwin)"), opened and closed 2026-07-18. It's fixed upstream by nixpkgs#536365, but per the issue thread the fix hadn't reached nixpkgs-unstable yet — confirmed locally: building watchexec against nixpkgs-unstable HEAD (right now) still SIGTRAPs with the same cctools-binutils-darwin-1010.6 error, while the previous pin (05988b07, 2026-07-08, what main is currently on) builds it cleanly.

Fix pushed: e3e1c75 reverts just the nixpkgs input in flake.lock back to 05988b07 (2026-07-08), keeping the rest of this PR's bumps (home-manager, nix-darwin, nix-homebrew, nix-vscode-extensions) intact. This is the workaround the nixpkgs maintainers themselves suggested in the issue thread while waiting for the fix to propagate to nixpkgs-unstable. Once it lands, a future nix flake update will naturally pick up the fixed revision.

Verified locally: `nix build .#checks.aarch64-darwin.build-dudupro` now succeeds end to end.