chore(nix): update nixpkgs to e62746b and refresh flake inputs (#488)

* chore(nix): update nixpkgs to e62746b and fix 26.11 breakage

Bump nixpkgs to e62746b and preservation to 00be7f7, then adapt to the removals and renamed options in the new revision: drop the removed boot.initrd.systemd.enable settings, trim the stale emSign CA blacklist on Linux while keeping it for the older Darwin input, and migrate Avahi publishing to settings.publish. Work around sunshine still setting the legacy Avahi options and keep dsh-nu on its tested Nushell 0.115.1. Patch NUR dsh's pnpm call to pass nodejs = null, and update pyclipsync for the stdenv.hostPlatform.system rename.

* chore(nix): refresh flake inputs for 26.11

- update nixpkgs-darwin to the same e62746b revision as nixpkgs
- make dsh-nu follow main nixpkgs and patch its testedWith manifest for the resolved Nushell
- refresh floating inputs; update lanzaboote, tuios, and ponytail
- drop the nixpkgs-2505 and rust-overlay workarounds
- keep pyclipsync on main and simplify the cross-platform CA blacklist
- adopt home-manager's Nushell loadSessionVariables default

* fix(gitea): use ROOT_URL for nixpkgs 26.11

nixpkgs removed the legacy settings.server.DOMAIN option; the existing ROOT_URL already carries the public URL.

* chore(nix): update dsh-nu to 0.7.0

Assisted-by: DeepSeek Harness (deepseek-flash)

docs/nixos-modernization-options.md

@@ -277,14 +277,13 @@ are hard to attribute; no measured problem to solve yet.
 **Current:** systemd-boot on akane, shoukei and the VM hosts (shoryu, shushou, youko); GRUB on
 `/dev/vda` on the libvirt guests kana and ruby; no bootloader on the MicroVM guests; on idols-ai and
 aquamarine, lanzaboote provides Secure Boot with a `/etc/secureboot` (lzpt) bundle. The lanzaboote
-flake input must track a rust-overlay follow (WA-003).
+flake input is maintained separately for Secure Boot.
 
 **Proposed:** `boot.loader.limine` — in nixpkgs, with `secureBoot`, `validateChecksums`,
 `panicOnChecksumMismatch`, `biosSupport`, `maxGenerations`, graphical menu.
 
 **Pros:** one bootloader for UEFI and BIOS (covers the qemu guests' GRUB case); Secure Boot without
-the lanzaboote flake input and its rust-overlay pin (WA-003 disappears); checksum validation of
-kernel and initrd; nicer menu.
+the lanzaboote flake input; checksum validation of kernel and initrd; nicer menu.
 
 **Cons:** different trust model — it signs **limine itself** and validates artifacts by checksum,
 rather than shipping a firmware-verified UKI, so `SECURITY.md` and the threat model must be updated;
@@ -532,7 +531,7 @@ header) should then be trimmed to **adopt** items only.
   `services/system/{userborn,nix-daemon,zram-generator}.nix`,
   `services/monitoring/prometheus/exporters.nix`.
 - NixOS 26.05 release notes; Nix manual, Experimental Features.
-- Repo context: `SECURITY.md` (trust zones and control limits), `WORKAROUNDS.md` (WA-001, WA-003,
-  WA-008, WA-009, WA-023), `modules/nixos/base/networking/mdns.nix`,
+- Repo context: `SECURITY.md` (trust zones and control limits), `WORKAROUNDS.md` (WA-001, WA-008,
+  WA-009, WA-023), `modules/nixos/base/networking/mdns.nix`,
   `hosts/12kingdoms-youko/homelab-services/caddy.nix`,
   `hosts/12kingdoms-youko/homelab-services/README.md`.