chore(flake): update nixpkgs to pick up cacert 3.131.1

Bumps nixos-unstable from 6510408 (2026-10-10) to 3ec6363 (2026-10-23),
which includes nixpkgs f903b88 (cacert 3.126 -> 3.131.1). NSS 3.131.1
drops emSign ECC Root CA - G3 after the eMudhra intermediate key
compromise.

nixpkgs removed the scripted initrd in this range, so
boot.initrd.systemd.enable is now a failing assertion. systemd initrd
was already enabled, so dropping the line does not change boot.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

flake.lock

@@ -258,11 +258,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1791594108,
-        "narHash": "sha256-XK4KceonkwD8LuMAt/vNrz982mXJM5jeHAxMwsUXXAQ=",
+        "lastModified": 1792773339,
+        "narHash": "sha256-rZLrzrC6i+jnTAlvPZHogKDulY7WWDEv9hJeHieO7Zw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "6510408d147d8c5e6d76043e899e9251756f6a75",
+        "rev": "3ec636362e1816bc2f0888fa0fa2c69f1bc9e504",
         "type": "github"
       },
       "original": {

modules/nixos/bootloader.nix

@@ -9,9 +9,6 @@
     efi.canTouchEfiVariables = true;
   };
 
-  # enable systemd initrd
-  boot.initrd.systemd.enable = true;
-
   # plymouth
   boot.plymouth = {
     enable = true;