chore: update flake inputs

[github-actions]

Automated update of flake inputs.

[adrian-gierakowski]

@copilot diagnose CI failure

[Copilot]

@copilot diagnose CI failure

The CI failure is in the docker-multiple-registries test with this error:

/run/current-system/sw/bin/kubenix-push-images: line 11: /nix/store/...-curl.tar.gz: Permission denied
FATA[0000] initializing source docker-archive:/dev/stdin: loading tar component "manifest.json": file does not exist

Root cause: The updated nixpkgs changed buildLayeredImage's passthru from { ... } to stream.passthru // { ... }. This inadvertently propagated isExe = true (set by the internal streamLayeredImage) to the buildLayeredImage result, even though that result is a .tar.gz file, not an executable stream script.

Kubenix's copyDockerImages checks image.isExe or false to decide whether to execute the image path as a command (for streaming images) or pass it directly to skopeo. With the new nixpkgs, buildLayeredImage images now have isExe = true, causing bash to try to execute the .tar.gz file and fail with "Permission denied".

Fix (commit b89b6af): Refactored lib/docker/default.nix to also check the output path suffix. If the path ends in .tar.gz, .tar.zst, or .tar, it's treated as a tarball regardless of the isExe attribute — correctly handling both old and new nixpkgs behavior.