Add router-upgrade for nixpkgs upgrades on the router

router.update.channel names the nixpkgs branch to follow (unstable or a
release like 26.05). router-upgrade check compares its newest tested
revision with the running one; preview locks a copy of the configuration
flake to it and lists the packages that change version and the size of the
download without fetching anything; download fetches it; apply takes the
lock and activates with commit-confirm, the lock going back on a rollback
or a failed build. router-update keeps an upgraded nixpkgs pinned.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

modules/settings/update.nix

@@ -144,6 +144,11 @@ let
 
       install -m 0644 "$release/flake.nix" "$config/flake.nix"
       rm -f "$config/flake.lock"
+      # A nixpkgs that router-upgrade chose stays, rather than the release's.
+      if [ -r "$config/nixpkgs-pin.json" ]; then
+        nix flake lock --override-input nixos-router/nixpkgs "$(jq -r .ref "$config/nixpkgs-pin.json")" "path:$config" \
+          || fail "pinning the upgraded nixpkgs failed"
+      fi
 
       router-migrate-settings "$release" "$config/settings.json" || fail "migrating the settings failed"
 
@@ -196,7 +201,9 @@ in
     assertions = lib.optional (config.routerSettings.release != null) {
       assertion = (settings.version or 0) == config.routerSettings.release.schema;
       message = ''
-        settings.json is at version ${toString (settings.version or 0)}, but this release of nixos-router expects
+        settings.json is at version ${
+          toString (settings.version or 0)
+        }, but this release of nixos-router expects
         version ${toString config.routerSettings.release.schema}. `router-update` migrates the settings; if you edited
         them by hand, set "version" accordingly.
       '';