Add router-upgrade for nixpkgs upgrades on the router

router.update.channel names the nixpkgs branch to follow (unstable or a
release like 26.05). router-upgrade check compares its newest tested
revision with the running one; preview locks a copy of the configuration
flake to it and lists the packages that change version and the size of the
download without fetching anything; download fetches it; apply takes the
lock and activates with commit-confirm, the lock going back on a rollback
or a failed build. router-update keeps an upgraded nixpkgs pinned.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

modules/router/options.nix

@@ -440,6 +440,18 @@ in
       '';
     };
 
+    update.channel = mkOption {
+      type = types.nullOr (types.strMatching "unstable|[0-9]{2}\\.[0-9]{2}");
+      default = null;
+      example = "26.05";
+      description = ''
+        The nixpkgs branch whose packages and kernel `router-upgrade` offers:
+        `unstable`, or a release like `26.05` (the branch `nixos-26.05`). It
+        takes effect when you upgrade, not when you apply the settings. null:
+        the packages that came with the installed release of nixos-router.
+      '';
+    };
+
     firewall.zones = mkOption {
       type = types.listOf types.str;
       default = [ ];