sharing flake inputs across services prevents selective updates

[steveej]

the most obvious input that's shared across almost all expressions in this repo is nixpkgs, however others like disko and srvos can also be problematic when dealing with single-machine updates.

this justifies a design spike and some thoughtful planning before jumping into an implementation.