fix(hardening): refresh wechat source hashes

Tencent replaced the file behind the versionless CDN URLs, so the pinned hashes stopped matching. Refresh the x86_64 and aarch64 hashes with nix store prefetch-file.

hardening/bwraps/wechat.nix

@@ -17,18 +17,21 @@ let
   sources = {
     # direct CDN urls, pinned by hash (same approach as nixpkgs' wechat package)
     # archive.org snapshots are not used because the CDN serves different builds per edge
+    # NOTE: Tencent replaces the file behind these versionless URLs, so the hashes
+    # must be refreshed with `nix store prefetch-file` whenever they stop matching.
+    # Last refreshed: 2026-09-19.
     aarch64-linux = {
       version = "4.1.1.8";
       src = fetchurl {
         url = "https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_arm64.AppImage";
-        hash = "sha256-RLHhac3wSS1C9rx3GsA07Tp1EzxSf2LLBMyPtrECnUY=";
+        hash = "sha256-zihf1qzRuhY2oKSP3qqIm3bS3/xWZRjRpfONxDe6kRc=";
       };
     };
     x86_64-linux = {
       version = "4.1.1.8";
       src = fetchurl {
         url = "https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.AppImage";
-        hash = "sha256-RX26ArkbAxzdRBLu4HT7v/udnQax5Q/Bgi00hw4RSZA=";
+        hash = "sha256-T1StKQLs1vb9xWgLc1R/gNVCO/RwsBI3pXmi5bPK7us=";
       };
     };
   };