Update Nix flake inputs

[github-actions]

Automated changes by the update-flake-lock GitHub Action.

Flake lock file updates:

• Updated input 'agenix':
    'github:ryantm/agenix/654f731' (2026-09-26)
  → 'github:ryantm/agenix/3daa710' (2026-09-30)
• Removed input 'agenix/darwin'
• Removed input 'agenix/darwin/nixpkgs'
• Removed input 'agenix/home-manager'
• Removed input 'agenix/home-manager/nixpkgs'
• Updated input 'agenix-rekey':
    'github:oddlama/agenix-rekey/8b9c179' (2026-03-26)
  → 'github:oddlama/agenix-rekey/87e5d5f' (2026-10-09)
• Added input 'agenix-rekey/flake-compat':
    'github:NixOS/flake-compat/5edf11c' (2025-12-29)
• Updated input 'colmena':
    'github:zhaofengli/colmena/4d2d652' (2026-09-23)
  → 'github:zhaofengli/colmena/e269669' (2026-10-09)
• Updated input 'colmena/stable':
    'github:nixos/nixpkgs/bd495b8' (2026-09-22)
  → 'github:nixos/nixpkgs/1f623a1' (2026-10-05)
• Updated input 'flake-parts':
    'github:hercules-ci/flake-parts/31729ca' (2026-09-03)
  → 'github:hercules-ci/flake-parts/024633c' (2026-10-01)
• Updated input 'flake-parts/nixpkgs-lib':
    'github:nix-community/nixpkgs.lib/596e2e3' (2026-08-30)
  → 'github:nix-community/nixpkgs.lib/f7cd230' (2026-09-27)
• Updated input 'git-hooks':
    'https://api.flakehub.com/f/pinned/cachix/git-hooks.nix/0.1.1243%2Brev-0d3997c4d3253505f77c9bcea63904bb575da3c5/01a0ca31-fbaa-75f0-b2fd-9fe556b26272/source.tar.gz' (2026-09-22)
  → 'https://api.flakehub.com/f/pinned/cachix/git-hooks.nix/0.1.1252%2Brev-a0e4241b51206fbcbf52fd322eb5f0cd80f153c4/01a0e3f1-aead-79d1-9f73-1a71c1a7d6cc/source.tar.gz' (2026-09-27)
• Updated input 'microvm':
    'github:astro/microvm.nix/68f2670' (2026-09-25)
  → 'github:astro/microvm.nix/f13928f' (2026-10-09)
• Updated input 'nix2container':
    'github:nlewo/nix2container/7ac0ae4' (2026-09-26)
  → 'github:nlewo/nix2container/4e83e67' (2026-10-02)
• Updated input 'nixpkgs-unstable':
    'github:NixOS/nixpkgs/f9bce96' (2026-09-26)
  → 'github:NixOS/nixpkgs/8edc0c7' (2026-10-08)
• Updated input 'prelude':
    'github:darkmatter/prelude/90ac25e' (2026-09-23)
  → 'github:darkmatter/prelude/908b359' (2026-10-10)
• Updated input 'process-compose-flake':
    'github:Platonic-Systems/process-compose-flake/464ff68' (2026-06-21)
  → 'github:Platonic-Systems/process-compose-flake/142d4b0' (2026-10-06)
• Updated input 'treefmt-nix':
    'https://api.flakehub.com/f/pinned/numtide/treefmt-nix/0.1.557%2Brev-27b3b12a8e6375f28ebe122f07d230ca5459bbfa/01a00ba7-ea6f-7822-ab05-cbad971fc7ca/source.tar.gz' (2026-08-16)
  → 'https://api.flakehub.com/f/pinned/numtide/treefmt-nix/0.1.682%2Brev-4cfe8d7065cc8ca91c0a50361b6dd74920eeb1f5/01a11f32-cd14-71f1-b96d-9005c00be10c/source.tar.gz' (2026-10-08)

Running GitHub Actions on this PR

GitHub Actions will not run workflows on pull requests which are opened by a GitHub Action.

To run GitHub Actions workflows on this PR, close and re-open this pull request.

[darkmatteragent]

Verified the analyze stage's zero-finding conclusion with independent reads. This PR is a machine-generated flake.lock refresh (update-flake-lock action); only flake.lock changed (+63/−92). Checks performed at head:

1. Lock graph consistency: every alias referenced after the diff resolves to an existing node. Read flake.lock:163-229 directly: the new flake-compat is NixOS/5edf11c (agenix-rekey's newly declared input), flake-compat_2 is edolstra/0f9255e, flake-compat_3 is NixOS/5edf11c. Pin identity across the renumbering is preserved: pre-commit-hooks moved from flake-compat (base: edolstra) to flake-compat_2 (edolstra, same rev/narHash), and git-hooks moved from flake-compat_2 (base: NixOS/5edf11c) to flake-compat_3 (NixOS/5edf11c, same rev/narHash). No consumer silently switched upstream revisions.

2. Removed transitive inputs (agenix's darwin/home-manager nodes) are inert: flake.nix only declares agenix.url and agenix.inputs.nixpkgs.follows = "nixpkgs" (flake.nix:25-26). Repo-wide search for "agenix" in nix/ hits only the untouched test-fixture lockfile and comments; no Nix code consumes inputs.agenix or its removed transitive inputs.

3. Remaining consumers of bumped pins (git-hooks, treefmt-nix, colmena, process-compose-flake, prelude, microvm, nix2container, nixpkgs-unstable) are reached through standard stable interfaces per the analyze trace; none can be shown to break from the lockfile diff alone, and no CI ran (Action-opened PR), so upstream regressions in the multi-month agenix-rekey / process-compose-flake / treefmt-nix jumps remain unverified risk — but unverified risk is not a provable patch-introduced defect, and I found no evidence it materializes.

No blockers, majors, minors, or nits on changed lines. The lockfile is internally consistent and semantically faithful to its declared inputs. Recommend merging after a maintainer triggers CI (close/reopen per the PR body) or runs nix flake check locally, as the pins are otherwise unverified — a merge-time verification step, not a finding against this diff.