straylight: sift CLI 8ca3ade on PATH at next switch

Pin follows approved CLI fail-closed for non-default HERMES_HOME.
Does not switch straylight or orion. ~/.local/bin/sift (e36da19)
still shadows until that binary is removed after the switch.

hw/straylight/default.nix

@@ -323,6 +323,9 @@ in
       # PATH before its self-downloaded ~/.hermes/bin/tirith). From unstable:
       # 26.05 only has 0.3.3, Hermes ships 0.4.x.
       pkgsUnstable.tirith
+      # CLI fail-closed for non-default HERMES_HOME. ~/.local/bin/sift currently
+      # shadows this until the next straylight switch + that binary is gone.
+      inputs.sift.packages.x86_64-linux.sift
     ];
 
     services.open-webui = {