deps: pin sqlite3 to commit SHA + bump zigDepsHash (was drifting heads/main, broke CI)

build.zig.zon pinned .sqlite3 to allyourcodebase/sqlite3 refs/heads/main, a
moving branch. Upstream bumped 3.51.0 -> 3.53.2, so the recorded .hash stopped
matching and the validate-zig-deps fixed-output derivation failed -> every
Garnix package/check on yolo failed. Not a code regression; a drifting
unpinned dependency.

Fix:
- Pin .url to immutable commit 7a615f5af79009cd733e3480658586d9b0d28b35 and
  update .hash to sqlite3-3.53.2-DMxLWuAOAAA_Px0arJOIOaP4AKEu5prbsQgPMA35W1zz.
- Bump flake.nix zigDepsHash to sha256-wbws7W8VYfb5gPyqXwr4N4MZV9phB505OH7UB8oIYUA=
  (the dep-tree FOD content changed with the sqlite bump). My first push fixed
  only build.zig.zon and built 'green' locally ONLY because the old FOD output
  was cached; Garnix, building clean, still hit the FOD hash mismatch on every
  platform. Forced re-derivation (fakeHash) to get the correct value.

NOTE: zlib (build.zig.zon:59) and openmpt (:67) still track refs/heads/
main|master with the same latent drift risk; pin to SHAs in a follow-up.

Author: pmarreck

build.zig.zon

@@ -60,8 +60,10 @@
             .hash = "zlib-1.3.2-ZZQ7lc8NAAAHm9MDfplvwoesXvk4tVm6VCsiI8KnIbT0",
         },
         .sqlite3 = .{
-            .url = "https://github.com/allyourcodebase/sqlite3/archive/refs/heads/main.tar.gz",
-            .hash = "sqlite3-3.51.0-DMxLWuAOAABO27GnPH0iTeI57EkQPpGwqI7LTfiE4Pda",
+            // Pinned to an immutable commit (was refs/heads/main, which drifted
+            // 3.51.0 -> 3.53.2 and broke CI on 2026-06-05). Pin SHA, not a branch.
+            .url = "https://github.com/allyourcodebase/sqlite3/archive/7a615f5af79009cd733e3480658586d9b0d28b35.tar.gz",
+            .hash = "sqlite3-3.53.2-DMxLWuAOAAA_Px0arJOIOaP4AKEu5prbsQgPMA35W1zz",
         },
         .libopenmpt = .{
             .url = "https://github.com/pmarreck/openmpt/archive/refs/heads/master.tar.gz",

flake.nix

@@ -29,7 +29,7 @@
 
 			# Pre-fetched Zig dependencies (fixed-output derivation)
 			# This hash must be updated when build.zig.zon changes
-			zigDepsHash = "sha256-mJ7ZwPArxCphgYKZe5Y5y93Zm3Hsh0oLfophTgDe3F4=";
+			zigDepsHash = "sha256-wbws7W8VYfb5gPyqXwr4N4MZV9phB505OH7UB8oIYUA=";
 		in {
 			# Packages for Garnix/Nix builds
 			packages = forBuildSystems (buildSystem: