fix(nix): update nixpkgs to fix crates.io 403 on crate downloads

[unhappychoice]

Unblocks the Nix Build check, which is currently red on every open PR (#496, #497).

Cause

nix build .#unstable fails while vendoring crates:

error: builder for '/nix/store/...-crate-ansi-to-tui-8.0.1.tar.gz.drv' failed with exit code 1
  > trying https://crates.io/api/v1/crates/ansi-to-tui/8.0.1/download
  > curl: (22) The requested URL returned error: 403
  > error: cannot download crate-ansi-to-tui-8.0.1.tar.gz from any mirror

crates.io now rejects requests that carry the default curl User-Agent, which is what nixpkgs fetchurl sends:

$ curl -o /dev/null -w '%{http_code}' -A 'curl/8.5.0' -L https://crates.io/api/v1/crates/ansi-to-tui/8.0.1/download
403
$ curl -o /dev/null -w '%{http_code}' -A 'Mozilla/5.0'  -L https://crates.io/api/v1/crates/ansi-to-tui/8.0.1/download
200

It is not a flake or a transient error — re-running the job reproduces it identically. Only crates missing from cache.nixos.org are affected, which is why it surfaced now: ansi-to-tui 8.0.1 happens not to be cached, so it is the first crate that has to be fetched for real.

Fix

The pinned nixpkgs (64c08a7, 2026-05-23) still builds the download URL from https://crates.io/api/v1/crates. Upstream has since switched importCargoLock to the static.crates.io CDN, which does not filter on User-Agent. Moving the input forward to 34ab990 (2026-08-31) picks that up.

Verification

$ nix build --no-link '.#unstable.cargoDeps'   # exit 0 — ansi-to-tui and all other crates vendor cleanly

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• flake.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 6cf035a0-b543-43c9-87c5-703ddd0cd5e2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.02%. Comparing base (753f2f7) to head (aaca16f).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #498   +/-   ##
=======================================
  Coverage   93.02%   93.02%           
=======================================
  Files         233      233           
  Lines       23095    23095           
=======================================
  Hits        21485    21485           
  Misses       1610     1610           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.