fix(renovate): lockstep flake.nix nixpkgs rev on devenv-nixpkgs bump (RIG-3099)

[rigel-mintaka]

RIG-3099: lockstep flake.nix nixpkgs rev on a devenv-nixpkgs bump

Problem

A Renovate bump of the cachix/devenv-nixpkgs digest fails CI on the
flake-gate:flake-parity gate, so the PR can never go green on its own
(observed on #580):

flake-gate:flake-parity | MISMATCH  flake.lock and devenv.lock pin different nixpkgs revisions:
flake-gate:flake-parity |   flake.lock   c946ff36…
flake-gate:flake-parity |   devenv.lock  256551e4…

Root cause

The devenv-nixpkgs customManager rewrites the channel rev in devenv.lock,
and its postUpgradeTask (refresh-devenv-nixpkgs.ts) re-locks devenv.lock +
bun.lock and rewrites the biome catalog pin — but never touches flake.nix
(which hard-codes the rev in inputs.nixpkgs.url) or flake.lock. The root
flake landed 2026-08-27..29 (RIG-2819/2888/2889), after this refresh script
was written, so the automation never learned to keep it in lockstep. The
flake-parity gate (tools/toolchain/flake-parity.ts) then reds on the skew.

Fix

Extend refresh-devenv-nixpkgs.ts with a step 6: after the devenv.lock re-lock,
rewrite flake.nix's inputs.nixpkgs.url to the new channel rev and
nix flake update nixpkgs to re-lock flake.lock. This is exactly the
remediation the gate's own error message prescribes ("align flake.nix's
inputs.nixpkgs.url + nix flake update nixpkgs"), mechanized.

• channelNixpkgsRev(devenvLockText) — reads devenv.lock's OUTER nixpkgs node
  (the channel rev flake.nix pins + the parity gate compares), distinct from the
  existing innerNixpkgsRev (the transitive nixpkgs-src).
• rewriteFlakeNixpkgsUrl(flakeNixText, newRev) — pure, fail-loud rewrite of the
  URL rev, mirroring rewriteCatalogPin.
• De-staled the flake.nix PIN DISCIPLINE comment (no longer names a literal rev
  that goes stale on each bump) and the config.json5 "no root flake" comment
  (flake now exists; nix manager stays off deliberately — an independent
  flake.lock bump would fight the devenv.lock lockstep the parity gate enforces).

Verification

• moon renovate:typecheck renovate:test — green (102 pass, 0 fail).
• Unit coverage: channelNixpkgsRev (outer-not-inner, fail-loud shape drift),
  rewriteFlakeNixpkgsUrl (rewrite, one-line change, idempotent, fail-loud).
• Entry-point harness: step 6 asserts flake.nix rewritten to the bumped channel
  rev + nix flake update ran, offline against stubs.
• Real-toolchain smoke: rewrote the URL rev on a copy of the live flake +
  nix flake update nixpkgs (nix 2.34.7) → flake.lock re-locked c946ff36→256551e
  exactly as designed.

Sibling gap RIG-3100 (Go bump can outrun the pinned go-overlay) is a separate PR
with a fix-approach fork for Matt.

[linear-code]

RIG-3099

[github-actions]

Compass engineering docs preview: https://dependencies-rig-3099-flake.compass-eng-docs.pages.dev

Deployed from dependencies/rig-3099-flake-parity-lockstep at 62e6b0c.