chore(packages): weekly upstream version bumps

Package the agent-native identity CLI for rook.host as buildNpmPackage,
with automated npm-github updates via upstream.json.

Automated update from scripts/update-packages.sh

Package matz/spinel (Ruby AOT compiler) as a Nix flake attr, vendor
prism/rbs gems for pure builds, and extend the updater for untagged
master tips so weekly CI can bump the pin.

Introduce scripts/update-packages.sh driven by packages/*/upstream.json,
plus a Monday cron (and workflow_dispatch) that refreshes hashes/lockfiles,
verifies nix builds, and opens a PR when anything changed.

Add a flake for third-party tools without upstream Nix support.
vit is built with buildNpmPackage from the GitHub v0.6.1 tag; a
regenerated package-lock.json is vendored because upstream's lock
lacks resolved URLs (breaks offline npmDeps caching).