nix: bump to nodejs_24 + pnpm_10, migrate to fetcherVersion 3

nixpkgs removed nodejs_20 (EOL 2026-04-30), pnpm_9 (EOL 2026-04-30), and
fetchPnpmDeps fetcherVersion = 2 (dropped in 26.11). All three threw at
eval, breaking every consumer of this flake.

- nodejs_20 -> nodejs_24 (current LTS). Prisma 6.19 supports Node 24.
- pnpm_9 -> pnpm_10; pnpm_8 -> pnpm_10 in the devshell. pnpm-lock.yaml is
  lockfileVersion 9.0, which pnpm 10 reads natively.
- fetcherVersion 2 -> 3, hash regenerated.

Builds clean against nixpkgs 56c02bc.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VyL5fiZuMB42fd9MUAJW7c

flake.nix

@@ -29,8 +29,8 @@
         {
           default = pkgs.mkShell {
             packages = with pkgs; [
-              nodejs_20
-              pnpm_8
+              nodejs_24
+              pnpm_10
               prisma
               prisma-engines
               python3

package.nix

@@ -1,8 +1,8 @@
 {
   lib,
   stdenv,
-  pnpm_9,
-  nodejs_20,
+  pnpm_10,
+  nodejs_24,
   makeWrapper,
   # Pin to prisma-engines_6 (6.19.3) — package.json's `@prisma/client` +
   # `prisma` are at ^6.19.0. The unversioned `prisma-engines` attr is now
@@ -45,19 +45,19 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = ./.;
 
-  pnpmDeps = pnpm_9.fetchDeps {
+  pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    fetcherVersion = 2;
+    fetcherVersion = 3;
     prePnpmInstall = patchNdk;
-    hash = "sha256-DE2Ol9uNoRn1vnBqTr7RZX8XZSb2bwXqdFmD93XmYGQ=";
+    hash = "sha256-gnEfkEmHCRxDcFRlT9rdlUR38xzOdhn8iDKcsYW7QY0=";
   };
 
   postPatch = patchNdk;
 
   nativeBuildInputs = [
-    pnpm_9.configHook
-    pnpm_9
-    nodejs_20
+    pnpm_10.configHook
+    pnpm_10
+    nodejs_24
     makeWrapper
     node-gyp
     python311
@@ -74,8 +74,8 @@ stdenv.mkDerivation (finalAttrs: {
   buildPhase = ''
     runHook preBuild
 
-    export npm_config_nodedir=${nodejs_20}
-    pnpm config set nodedir ${nodejs_20}
+    export npm_config_nodedir=${nodejs_24}
+    pnpm config set nodedir ${nodejs_24}
 
     # configHook ran with --ignore-scripts; re-run install to trigger
     # native-module postinstall (bcrypt). --offline keeps it inside the
@@ -114,17 +114,17 @@ stdenv.mkDerivation (finalAttrs: {
     # interfering with how the launcher finds its own package files.
     # NSEC_BUNKER_CONFIG_DIR can override the config directory location;
     # by default it's `./config` relative to cwd.
-    makeWrapper ${lib.getExe nodejs_20} $out/bin/nsecbunkerd \
+    makeWrapper ${lib.getExe nodejs_24} $out/bin/nsecbunkerd \
       --add-flags $out/share/nsecbunkerd/scripts/start.js \
       --set NODE_ENV production \
-      --prefix PATH : ${lib.makeBinPath [ openssl nodejs_20 ]} \
+      --prefix PATH : ${lib.makeBinPath [ openssl nodejs_24 ]} \
       ${
         lib.concatStringsSep " \\\n      " (
           lib.mapAttrsToList (n: v: "--set ${n} ${lib.escapeShellArg v}") prismaEnv
         )
       }
 
-    makeWrapper ${lib.getExe nodejs_20} $out/bin/nsecbunker-client \
+    makeWrapper ${lib.getExe nodejs_24} $out/bin/nsecbunker-client \
       --chdir $out/share/nsecbunkerd \
       --add-flags $out/share/nsecbunkerd/dist/client/client.js \
       --set NODE_ENV production