build(nix): pin the Rust toolchain to 1.97.1 via rust-overlay

nixpkgs 26.05 ships rustc 1.95.0, but this crate was developed and verified on
1.97.1 (what CachyOS had, installed 2026-07-17). Taking the compiler from
oxalica/rust-overlay decouples "which Rust the project targets" from "which
release the audio stack came from", so a nixpkgs bump can no longer move the
compiler under the lint gate as a side effect.

Chosen over rustup, which would also have worked here (nix-ld is enabled, so
its prebuilt binaries run) and would have let one rust-toolchain.toml cover the
packaging distroboxes too. The deciding factor is purity: rustup records
nothing in flake.lock, so a fresh clone or darp5 would resolve whatever it
fetched that day. rust-overlay gives the same exact-version control with the
choice pinned in the lock.

`.default` is the rustup "default" profile — rustc, cargo, rust-std, rustfmt
and clippy — so those are no longer listed individually. No windows-gnu target
here: pixelpass is Linux-only, unlike peerspeak.

Verified on 1.97.1: 256 tests pass, fmt clean, and `cargo clippy --all-targets
-- -D warnings` is clean.

flake.lock

@@ -18,7 +18,28 @@
     },
     "root": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "rust-overlay": "rust-overlay"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1786076960,
+        "narHash": "sha256-jfR6OhwurCKn1tREyfOcK/Omxf1Q/DzDDFbnEr1mBLs=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "57a23bfaf4f7017267294b161175db1e32eb1c85",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
       }
     }
   },

flake.nix

@@ -1,16 +1,44 @@
 {
   description = "PixelPass — P2P screen sharing CLI over iroh";
 
-  # Same channel the hosts run (nixos-config tracks nixos-26.05). The capture
-  # path talks to the live PipeWire daemon and the system PulseAudio server, so
-  # the client libraries here should come from the same release the server did.
-  inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-26.05";
+  inputs = {
+    # Same channel the hosts run (nixos-config tracks nixos-26.05). The capture
+    # path talks to the live PipeWire daemon and the system PulseAudio server,
+    # so the client libraries here should come from the same release the server
+    # did.
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-26.05";
+
+    # The Rust toolchain is pinned SEPARATELY from the system libraries, so a
+    # nixpkgs bump cannot move the compiler under the lint gate. nixpkgs 26.05
+    # ships 1.95.0; this crate was developed and verified on 1.97.1, and
+    # peerspeak — the sibling project this one is built against — has a clippy
+    # lint that differs between exactly those two versions. Keeping both repos
+    # on one pinned compiler means a check that passes here passes there.
+    #
+    # This is the reproducible alternative to rustup: the same exact-version
+    # control, but recorded in flake.lock, so a fresh clone resolves the
+    # identical toolchain rather than whatever rustup fetches that day.
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
 
   outputs =
-    { nixpkgs, ... }:
+    { nixpkgs, rust-overlay, ... }:
     let
       system = "x86_64-linux";
-      pkgs = nixpkgs.legacyPackages.${system};
+      pkgs = import nixpkgs {
+        inherit system;
+        overlays = [ rust-overlay.overlays.default ];
+      };
+
+      # Matches what CachyOS shipped (rust 1:1.97.1-1) and what peerspeak pins.
+      # `default` is the rustup "default" profile — rustc, cargo, rust-std,
+      # rustfmt and clippy — so those are NOT listed separately below. No
+      # windows-gnu target here: pixelpass is Linux-only (portal/PipeWire/X11
+      # capture), unlike peerspeak which has a Windows port.
+      rustToolchain = pkgs.rust-bin.stable."1.97.1".default;
 
       # GStreamer is driven as a SUBPROCESS (gst-launch-1.0 / gst-inspect-1.0),
       # not linked — there is no gstreamer-sys in Cargo.lock. So these are PATH
@@ -41,13 +69,8 @@
     {
       devShells.${system}.default = pkgs.mkShell {
         nativeBuildInputs =
-          with pkgs;
-          [
-            rustc
-            cargo
-            rustfmt
-            clippy
-
+          [ rustToolchain ]
+          ++ (with pkgs; [
             # Debian packaging (`cargo deb --no-build`). Build the binary
             # inside a Debian/Ubuntu distrobox first so it links that distro's
             # glibc — see the packaging notes in Cargo.toml.
@@ -58,7 +81,7 @@
             # pipewire-sys, libspa-sys and libpulse-sys all generate bindings
             # with bindgen, which needs a real libclang at build time.
             clang
-          ]
+          ])
           ++ gstPlugins
           ++ [
             # The rest of what `deps::check_host_binaries` looks for.