straylight: sift CLI 8ca3ade on PATH at next switch

Pin follows approved CLI fail-closed for non-default HERMES_HOME.
Does not switch straylight or orion. ~/.local/bin/sift (e36da19)
still shadows until that binary is removed after the switch.

flake.lock

@@ -446,16 +446,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1790191351,
-        "narHash": "sha256-XJhq+BEccNUP8FLnpkuZhrxDqhW+Yq9uXmN9Pf0MESQ=",
+        "lastModified": 1790192357,
+        "narHash": "sha256-tG3THukZh1woEbmSEWoaDFjQaGE1rdZBTPF3/6OTC4w=",
         "ref": "refs/heads/master",
-        "rev": "429f6b207eab4bb480f21ca5dd9caafb6b55e9d5",
-        "revCount": 34,
+        "rev": "8ca3adec9e53326db063c3e768e81a91037b3765",
+        "revCount": 35,
         "type": "git",
         "url": "ssh://git@git.wntrmute.dev/kyle/sift"
       },
       "original": {
-        "rev": "429f6b207eab4bb480f21ca5dd9caafb6b55e9d5",
+        "rev": "8ca3adec9e53326db063c3e768e81a91037b3765",
         "type": "git",
         "url": "ssh://git@git.wntrmute.dev/kyle/sift"
       }

flake.nix

@@ -23,7 +23,7 @@
     tracker.url = "git+https://git.wntrmute.dev/kyle/tracker";
     tracker.inputs.nixpkgs.follows = "nixpkgs";
 
-    sift.url = "git+ssh://git@git.wntrmute.dev/kyle/sift?rev=429f6b207eab4bb480f21ca5dd9caafb6b55e9d5";
+    sift.url = "git+ssh://git@git.wntrmute.dev/kyle/sift?rev=8ca3adec9e53326db063c3e768e81a91037b3765";
     sift.inputs.nixpkgs.follows = "nixpkgs";
 
     tether.url = "git+ssh://git@git.wntrmute.dev/kyle/tether?rev=c89894b8dcac89aaea9ad72529524c1204884bc0";

hw/straylight/default.nix

@@ -323,6 +323,9 @@ in
       # PATH before its self-downloaded ~/.hermes/bin/tirith). From unstable:
       # 26.05 only has 0.3.3, Hermes ships 0.4.x.
       pkgsUnstable.tirith
+      # CLI fail-closed for non-default HERMES_HOME. ~/.local/bin/sift currently
+      # shadows this until the next straylight switch + that binary is gone.
+      inputs.sift.packages.x86_64-linux.sift
     ];
 
     services.open-webui = {