fix(nix): derive npm deps from lockfile via importNpmLock

[airadier]

Problem

Every Dependabot dependency PR fails the test-nix check with a Nix hash mismatch, e.g.:

error: hash mismatch for sysdig-vscode-ext-vsix-…-npm-deps
To correct the hash mismatch … use "sha256-…"

vsix.nix pins a fixed-output npmDepsHash derived from package-lock.json. Any lockfile change (i.e. every dependency bump) changes that hash, so the build fails until the hash is manually updated — something Dependabot cannot do. This blocks PRs #40, #41, #42, #44, #46 and every future bump.

Fix

Replace the pinned npmDepsHash with importNpmLock, which reads dependencies directly from package-lock.json with no fixed-output hash:

npmDeps = importNpmLock { npmRoot = ./.; };
npmConfigHook = importNpmLock.npmConfigHook;

After this, dependency bumps no longer touch any Nix hash — test-nix stays green on a plain rebase.

Verification

Built locally on macOS against nixpkgs-unstable:

$ nix build .#sysdig-vscode-vsix
…
DONE  Packaged: sysdig-vscode-ext-0.2.16.vsix (198 files, 353.03 KB)

Follow-up

Once merged, the open Dependabot PRs just need @dependabot rebase to go green — no per-PR hash edits.

[tembleking]

Nice, can you also remove this part if it's not needed anymore?

vscode-extension/Justfile

Lines 35 to 36 in 727ff13

	rehash-npm-nix:
	sd 'npmDepsHash = ".*";' "npmDepsHash = \"$(nix hash convert --to sri $(prefetch-npm-deps ./package-lock.json))\";" vsix.nix

[airadier]

Good catch @tembleking — done in 332ee45. Since there is no longer a fixed-output hash to maintain, I removed the whole rehash machinery, not just the recipe:

• rehash-npm-nix recipe in the Justfile
• its call inside just update
• the rehash pre-commit hook (would have failed once the recipe was gone)
• the now-unused prefetch-npm-deps package from the devShell

Re-verified locally: nix build .#sysdig-vscode-vsix packages the vsix and the devShell still evaluates.