Update Nix flake inputs

[github-actions]

Automated changes by the update-flake-lock GitHub Action.

Flake lock file updates:

• Updated input 'agenix':
    'github:ryantm/agenix/654f731' (2026-09-26)
  → 'github:ryantm/agenix/3daa710' (2026-09-30)
• Removed input 'agenix/darwin'
• Removed input 'agenix/darwin/nixpkgs'
• Removed input 'agenix/home-manager'
• Removed input 'agenix/home-manager/nixpkgs'
• Updated input 'agenix-rekey':
    'github:oddlama/agenix-rekey/8b9c179' (2026-03-26)
  → 'github:oddlama/agenix-rekey/87e5d5f' (2026-10-09)
• Added input 'agenix-rekey/flake-compat':
    'github:NixOS/flake-compat/5edf11c' (2025-12-29)
• Updated input 'blueprint':
    'github:numtide/blueprint/8be7524' (2026-09-02)
  → 'github:numtide/blueprint/2bf1235' (2026-10-13)
• Updated input 'colmena':
    'github:zhaofengli/colmena/4d2d652' (2026-09-23)
  → 'github:zhaofengli/colmena/e269669' (2026-10-09)
• Updated input 'colmena/stable':
    'github:nixos/nixpkgs/bd495b8' (2026-09-22)
  → 'github:nixos/nixpkgs/1f623a1' (2026-10-05)
• Updated input 'flake-parts':
    'github:hercules-ci/flake-parts/31729ca' (2026-09-03)
  → 'github:hercules-ci/flake-parts/024633c' (2026-10-01)
• Updated input 'flake-parts/nixpkgs-lib':
    'github:nix-community/nixpkgs.lib/596e2e3' (2026-08-30)
  → 'github:nix-community/nixpkgs.lib/f7cd230' (2026-09-27)
• Updated input 'flake-utils':
    'https://api.flakehub.com/f/pinned/numtide/flake-utils/0.1.102%2Brev-11707dc2f618dd54ca8739b309ec4fc024de578b/0193276d-5b8f-7dbc-acf1-41cb7b54ad2e/source.tar.gz' (2024-11-13)
  → 'https://api.flakehub.com/f/pinned/numtide/flake-utils/0.1.104%2Brev-b7a79d3fea1e214f6d668d521cecec0c01e26544/01a13688-ab44-7252-9946-609183ce150d/source.tar.gz' (2026-10-13)
• Updated input 'git-hooks':
    'https://api.flakehub.com/f/pinned/cachix/git-hooks.nix/0.1.1243%2Brev-0d3997c4d3253505f77c9bcea63904bb575da3c5/01a0ca31-fbaa-75f0-b2fd-9fe556b26272/source.tar.gz' (2026-09-22)
  → 'https://api.flakehub.com/f/pinned/cachix/git-hooks.nix/0.1.1262%2Brev-1ba1dbfe28738c9a71c266be6efa5b89e75491a9/01a1365c-ea95-7183-93b0-1dc6ae52e058/source.tar.gz' (2026-10-13)
• Updated input 'microvm':
    'github:astro/microvm.nix/68f2670' (2026-09-25)
  → 'github:astro/microvm.nix/f13928f' (2026-10-09)
• Updated input 'nix2container':
    'github:nlewo/nix2container/7ac0ae4' (2026-09-26)
  → 'github:nlewo/nix2container/535166e' (2026-10-17)
• Updated input 'nixpkgs-unstable':
    'github:NixOS/nixpkgs/f9bce96' (2026-09-26)
  → 'github:NixOS/nixpkgs/f20cd90' (2026-10-16)
• Updated input 'prelude':
    'github:darkmatter/prelude/90ac25e' (2026-09-23)
  → 'github:darkmatter/prelude/c1c01a3' (2026-10-14)
• Updated input 'process-compose-flake':
    'github:Platonic-Systems/process-compose-flake/464ff68' (2026-06-21)
  → 'github:Platonic-Systems/process-compose-flake/8e27bc9' (2026-10-14)
• Updated input 'treefmt-nix':
    'https://api.flakehub.com/f/pinned/numtide/treefmt-nix/0.1.557%2Brev-27b3b12a8e6375f28ebe122f07d230ca5459bbfa/01a00ba7-ea6f-7822-ab05-cbad971fc7ca/source.tar.gz' (2026-08-16)
  → 'https://api.flakehub.com/f/pinned/numtide/treefmt-nix/0.1.684%2Brev-0d6d739a833ba9a9c93034862e4a7b061a062a1c/01a1365c-d9b4-72b0-aadd-ca40080e575b/source.tar.gz' (2026-10-13)

Running GitHub Actions on this PR

GitHub Actions will not run workflows on pull requests which are opened by a GitHub Action.

To run GitHub Actions workflows on this PR, close and re-open this pull request.

[darkmatteragent]

Verified the analyze stage's zero-finding conclusion with independent reads. This PR is a machine-generated flake.lock refresh (update-flake-lock action); only flake.lock changed (+63/−92). Checks performed at head:

1. Lock graph consistency: every alias referenced after the diff resolves to an existing node. Read flake.lock:163-229 directly: the new flake-compat is NixOS/5edf11c (agenix-rekey's newly declared input), flake-compat_2 is edolstra/0f9255e, flake-compat_3 is NixOS/5edf11c. Pin identity across the renumbering is preserved: pre-commit-hooks moved from flake-compat (base: edolstra) to flake-compat_2 (edolstra, same rev/narHash), and git-hooks moved from flake-compat_2 (base: NixOS/5edf11c) to flake-compat_3 (NixOS/5edf11c, same rev/narHash). No consumer silently switched upstream revisions.

2. Removed transitive inputs (agenix's darwin/home-manager nodes) are inert: flake.nix only declares agenix.url and agenix.inputs.nixpkgs.follows = "nixpkgs" (flake.nix:25-26). Repo-wide search for "agenix" in nix/ hits only the untouched test-fixture lockfile and comments; no Nix code consumes inputs.agenix or its removed transitive inputs.

3. Remaining consumers of bumped pins (git-hooks, treefmt-nix, colmena, process-compose-flake, prelude, microvm, nix2container, nixpkgs-unstable) are reached through standard stable interfaces per the analyze trace; none can be shown to break from the lockfile diff alone, and no CI ran (Action-opened PR), so upstream regressions in the multi-month agenix-rekey / process-compose-flake / treefmt-nix jumps remain unverified risk — but unverified risk is not a provable patch-introduced defect, and I found no evidence it materializes.

No blockers, majors, minors, or nits on changed lines. The lockfile is internally consistent and semantically faithful to its declared inputs. Recommend merging after a maintainer triggers CI (close/reopen per the PR body) or runs nix flake check locally, as the pins are otherwise unverified — a merge-time verification step, not a finding against this diff.