fix: pin Flatpak to 1.16.6 to work around sandbox env leak bug

Flatpak >=1.18.0 leaks the NixOS host environment into the sandbox,
breaking glycin-svg icon loading (e.g. OpenDeck). Pin services.flatpak.package
to a nixpkgs-flatpak input locked to a revision with Flatpak 1.16.6, scoped
to the Flatpak service only, until flatpak/flatpak#6721 lands in nixpkgs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

flake.lock

@@ -265,6 +265,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-flatpak": {
+      "locked": {
+        "lastModified": 1781332575,
+        "narHash": "sha256-tyh5yzbIN2ftH+uilyTWR6WCMZQeh3m5iOowTLNodyk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "51effaf9783e0226281ad10e95a4af6c8a145316",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "51effaf9783e0226281ad10e95a4af6c8a145316",
+        "type": "github"
+      }
+    },
     "nixpkgs_2": {
       "locked": {
         "lastModified": 1783475452,
@@ -347,6 +363,7 @@
         "nix-flatpak": "nix-flatpak",
         "nix-vscode-extensions": "nix-vscode-extensions",
         "nixpkgs": "nixpkgs_4",
+        "nixpkgs-flatpak": "nixpkgs-flatpak",
         "sidra": "sidra",
         "vscode-server": "vscode-server"
       }

flake.nix

@@ -18,6 +18,14 @@
     vscode-server.url = "github:nix-community/nixos-vscode-server";
     llm-agents.url = "github:numtide/llm-agents.nix";
     nix-vscode-extensions.url = "github:nix-community/nix-vscode-extensions";
+
+    # TEMPORARY: pinned to the last nixpkgs revision known to ship Flatpak 1.16.6.
+    # Flatpak >=1.18.0 leaks the NixOS host environment into the sandbox and breaks
+    # glycin-svg icon loading (e.g. OpenDeck). Remove this input, the overlay-less
+    # services.flatpak.package override below, and this comment once
+    # https://github.com/flatpak/flatpak/issues/6721 is fixed upstream and merged
+    # into nixpkgs (see also flatpak/flatpak#6717, NixOS/nixpkgs#534376).
+    nixpkgs-flatpak.url = "github:NixOS/nixpkgs/51effaf9783e0226281ad10e95a4af6c8a145316";
   };
 
   outputs = { self, nixpkgs, apple-fonts, home-manager, sidra, vscode-server, nix-vscode-extensions, ... }@inputs: {

modules/services/flatpak.nix

@@ -1,7 +1,15 @@
+{ inputs, pkgs, ... }:
+
 {
   services.flatpak = {
     enable = true;
 
+    # TEMPORARY: pin Flatpak itself to 1.16.6 via nixpkgs-flatpak (see flake.nix).
+    # Flatpak >=1.18.0 leaks the NixOS host environment into the sandbox and breaks
+    # glycin-svg icon loading (e.g. OpenDeck). Remove once
+    # https://github.com/flatpak/flatpak/issues/6721 lands in nixpkgs.
+    package = inputs.nixpkgs-flatpak.legacyPackages.${pkgs.system}.flatpak;
+
     remotes = [
       {
         name = "flathub";