Fix CI failures from flake.lock update: nixos-25.05 compatibility

[Copilot]

The automated flake.lock update pulled in newer versions of srvos, devenv, and treefmt-nix that are incompatible with nixos-25.05.

treefmt-nix breaking changes

• nixfmt: Default package changed from nixfmt-rfc-style to nixfmt (classic), which can't parse the |> pipe operator used throughout the codebase. Pinned back to pkgs.nixfmt-rfc-style.
• nixf-diagnose: New autoFix = true default passes --auto-fix flag not supported by the nixos-25.05 version. Disabled.

srvos incompatibility

New srvos uses systemd.settings.Manager for watchdog config — an option that doesn't exist until newer nixpkgs. Added a compatibility shim that defines the option and converts it to systemd.extraConfig:

({ config, lib, ... }:
  let managerSettings = config.systemd.settings.Manager or { };
  in {
    options.systemd.settings = lib.mkOption {
      type = lib.types.attrsOf (lib.types.attrsOf lib.types.str);
      default = { };
    };
    config = lib.mkIf (managerSettings != { }) {
      systemd.extraConfig = lib.concatStringsSep "\n" (
        lib.mapAttrsToList (key: value: "${key}=${value}") managerSettings
      );
    };
  })

devenv incompatibility

New devenv defaults git-hooks.package to pkgs.prek (a pre-commit replacement not in nixos-25.05). Overridden with pkgs.pre-commit.

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.