Bump tangled to latest master (post-v1.13.0-alpha) and pin in auto-update

The tangled core was on rev 956f97c (v1.11.0-alpha) and v1.13.0-alpha
introduces automatic DID minting for repositories which we want.

Master HEAD (6a27cd2) is post-v1.13.0-alpha and includes the DID
auto-mint migration. After deploy, retry verification on the knot
dashboard at https://tangled.org/settings/knots.

Note: the build's reported version string is hardcoded to 1.11.0-alpha
in nix/pkgs/knot-unwrapped.nix upstream -- this is a stale label, but
the actual code includes v1.13.0-alpha features (DID minting schema in
knotserver/db/db.go).

Also add an explicit `nix flake update tangled` to auto-update.nix so
tangled is always tracked, independent of how other inputs are pinned.

flake.lock

@@ -188,11 +188,11 @@
         "lastModified": 1731402384,
         "narHash": "sha256-OwUmrPfEehLDz0fl2ChYLK8FQM2p0G1+EMrGsYEq+6g=",
         "type": "tarball",
-        "url": "https://github.com/IBM/plex/releases/download/@ibm/plex-mono@1.1.0/ibm-plex-mono.zip"
+        "url": "https://github.com/IBM/plex/releases/download/@ibm%2Fplex-mono@1.1.0/ibm-plex-mono.zip"
       },
       "original": {
         "type": "tarball",
-        "url": "https://github.com/IBM/plex/releases/download/@ibm/plex-mono@1.1.0/ibm-plex-mono.zip"
+        "url": "https://github.com/IBM/plex/releases/download/@ibm%2Fplex-mono@1.1.0/ibm-plex-mono.zip"
       }
     },
     "indigo": {
@@ -351,11 +351,11 @@
         "sqlite-lib-src": "sqlite-lib-src"
       },
       "locked": {
-        "lastModified": 1776427995,
+        "lastModified": 1777129244,
-        "narHash": "sha256-bUR/cHqZP1zigWCo59KFF+F6UDuGM9q5CiFHdvnvSO8=",
+        "narHash": "sha256-4+f+RrVXbtBRuffJg6QyANOc/H9MMpp9PjnxwlUU6Hk=",
         "ref": "refs/heads/master",
-        "rev": "956f97c314517efbfa18d04ce8e0234e6609a30a",
+        "rev": "6a27cd259b67bdad85e8d82a31543cc11c309fc6",
-        "revCount": 2250,
+        "revCount": 2274,
         "type": "git",
         "url": "https://tangled.org/@tangled.org/core"
       },

hosts/asusmini/auto-update.nix

@@ -3,7 +3,11 @@
 {
   systemd.services.auto-update = {
     description = "Auto-update NixOS configuration";
-    path = with pkgs; [ git nix openssh ];
+    path = with pkgs; [
+      git
+      nix
+      openssh
+    ];
 
     serviceConfig = {
       Type = "oneshot";
@@ -20,6 +24,12 @@
       echo "Updating flake inputs..."
       nix flake update
 
+      # Explicitly update tangled so we always pull the latest knot/spindle
+      # builds, even if other inputs are pinned or the general update is
+      # later restricted. tangled.org/@tangled.org/core moves quickly and
+      # we want to track master.
+      nix flake update tangled
+
       # Check if there are changes to commit
       if ! git diff --quiet flake.lock; then
         echo "Committing flake.lock updates..."
@@ -46,9 +56,9 @@
     description = "Auto-update timer";
     wantedBy = [ "timers.target" ];
     timerConfig = {
-      OnCalendar = "weekly";  # Run weekly, adjust as needed
+      OnCalendar = "weekly"; # Run weekly, adjust as needed
-      Persistent = true;  # Run on boot if missed
+      Persistent = true; # Run on boot if missed
-      RandomizedDelaySec = "1h";  # Add some randomness
+      RandomizedDelaySec = "1h"; # Add some randomness
     };
   };