Bake the channel manifest's closure instead of a pinned app version

Production builds failed CI's baseline preflight because flake.nix pinned
the app to tag 1.8 (channel.appVersion = "1.8") while the published
manifest had moved on to 1.9; dev was likewise pinned to a stale commit.

Stop pinning the app anywhere. flake.nix now fetches the channel's
published manifest at eval time (builtins.fetchurl) and bakes its
storePath verbatim, so every image carries exactly the closure RadiantWave
published to Attic and never compiles the app from source.

- flake.nix: drop the radiantwave/radiantwave-dev inputs, appInput,
  appVersion, channelVersion and baselineOutPaths; add channelAtticUrl,
  channelManifestDir and publishedApp; builders consume the published path.
- configuration.nix: wrap the published store path in a symlinkJoin so it
  can live in environment.systemPackages; add --impure to autoUpgrade
  flags and set tarball-ttl = 0 so eval reads the current manifest.
- radiantwave-updater.nix: baselinePackage (package) -> baselinePath (str),
  seeded from the exact manifest path.
- CI (build.yml, build-rpi.yml): replace the version-equality preflight with
  a fail-fast check that the announced closure is in the channel's Attic;
  set tarball-ttl = 0.
- build-rpi.sh: pass --impure.
- AGENTS.md: document the manifest-driven baseline.

configuration.nix

@@ -2,6 +2,14 @@
 
 let
   radiantApp = radiantwaveApp;
+  # The published app arrives as a bare store-path string (from the channel
+  # manifest, see flake.nix). Wrap it in a derivation built with this system's
+  # pkgs so it can live in environment.systemPackages; the wrapper is a symlink
+  # farm and the real closure is substituted from the channel's Attic cache.
+  radiantAppPackage = pkgs.symlinkJoin {
+    name = "radiantwave-published";
+    paths = [ radiantApp ];
+  };
   # When the live-updater module is enabled, RadiantWave launches through the
   # mutable /var/lib/radiantwave/current
   # pointer so it can be swapped without a full nixos-rebuild. Otherwise it
@@ -32,7 +40,7 @@ in
   # Included packages
   environment.systemPackages = [
     pkgs.cage pkgs.rsync pkgs.dbus pkgs.mesa pkgs.git pkgs.tailscale pkgs.sqlite pkgs.wireplumber
-    radiantApp
+    radiantAppPackage
   ];
 
   # This populates the EFI partition and tells the NUC how to start NixOS.
@@ -222,7 +230,9 @@ in
     enable = true;
     flake = upgradeFlakeRef;
     dates = "*:00/10";
-    flags = [ "--refresh" "-L" ];
+    # --impure: the flake reads the channel's published manifest at eval time
+    # (builtins.fetchurl) to pick the app store path for the next generation.
+    flags = [ "--refresh" "--impure" "-L" ];
     operation = "switch";
   };
 
@@ -249,6 +259,11 @@ in
   # NixOS settings.
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   nix.settings.accept-flake-config = true;
+  # The app baked into each generation comes from the channel's published
+  # manifest, fetched at eval time with `builtins.fetchurl` (see flake.nix).
+  # Disable the tarball cache so a rebuild during autoUpgrade always reads the
+  # current manifest instead of a copy up to an hour old.
+  nix.settings.tarball-ttl = 0;
   nix.settings.extra-substituters = [
     "https://attic.radiantwavetech.com/radiantwave"
     "https://attic.radiantwavetech.com/radiantwave-dev"