Code Quality: Update the Nix flake to 0.1.0-alpha8

.github/README.md

@@ -64,7 +64,7 @@ programs.linuxfiles = {
 };
 ```
 
-This installs a patched helper, a matching polkit action and trusted deployment manifest, and enables the pkexec wrapper. A session authentication agent is required. The flake currently pins alpha7, which supports this opt-in; it will be updated to alpha8 after the release assets and hashes are published. A runtime-capability assertion rejects incompatible or unmarked package overrides. See [Nix packaging details](../docs/linux-port/packaging.md#nix-flake).
+This installs a patched helper, a matching polkit action and trusted deployment manifest, and enables the pkexec wrapper. A session authentication agent is required. The flake pins alpha8, which supports this opt-in. A runtime-capability assertion rejects incompatible or unmarked package overrides. See [Nix packaging details](../docs/linux-port/packaging.md#nix-flake).
 
 ### AppImage
 

docs/linux-port/packaging.md

@@ -174,7 +174,7 @@ The module selects the package's `enableRootActions` variant, removes its disabl
 
 `pkexec` uses `/run/wrappers/bin` before the system profile and `/usr/bin`/`/bin`. The module enables `security.polkit.enablePkexecWrapper` when present; older nixpkgs uses `security.wrappers.pkexec`. Only pkexec is setuid, never the LinuxFiles helper. A session authentication agent and an administrator identity are still required. The narrow store exception accepts a root-owned sticky `/nix/store` with group write (1775), but rejects other write there, non-root ownership, and any writable entries beneath it. Native `/usr` helper/policy checks retain their existing restrictions.
 
-**Release integration:** the current pin is `0.1.0-alpha7`; like alpha4 to alpha6, it includes deployment-manifest and Nix elevation-wrapper discovery. Its `passthru.supportsNixRootActions` marker is true, so the module accepts `rootActions = true`. Overrides with a false or missing marker are still rejected by the runtime-capability assertion. For future releases, verify that both runtime changes are present before retaining the compatible-runtime marker.
+**Release integration:** the current pin is `0.1.0-alpha8`; like alpha4 to alpha7, it includes deployment-manifest and Nix elevation-wrapper discovery. Its `passthru.supportsNixRootActions` marker is true, so the module accepts `rootActions = true`. Overrides with a false or missing marker are still rejected by the runtime-capability assertion. For future releases, verify that both runtime changes are present before retaining the compatible-runtime marker.
 
 Per release (after CI has attached `SHA256SUMS`; the flake's tag is `linux-v<version>`):
 

flake.nix

@@ -18,15 +18,15 @@
            , icu, openssl, zlib, krb5, glib, enableRootActions ? false }:
             let
               # version and both hashes are rewritten by scripts/linux/update-nix-flake.sh
-              version = "0.1.0-alpha7";
+              version = "0.1.0-alpha8";
               base = "https://github.com/MemerGamer/LinuxFiles/releases/download/linux-v${version}";
               app = fetchurl {
                 url = "${base}/files-linux-x64.tar.gz";
-                hash = "sha256-FNGHD+KmM98mw/ikmIeO44bel4Ts3fsFhZgFmreBXSk=";
+                hash = "sha256-cN0r4F7Mytw6tkLvcdyaMMB6/CcZnsFTfn6L7H133BA=";
               };
               packaging = fetchurl {
                 url = "${base}/files-packaging.tar.gz";
-                hash = "sha256-GVfnUOPC2S0hEwAiaiRSpc3npSZSdrqhLpF5I9+GVTs=";
+                hash = "sha256-6KKT6JoYn+PZNlklz+4w7Eaf/R3OAeBp44FTJSoYpUc=";
               };
               # Opened with dlopen at runtime, so autoPatchelf cannot discover them; added to every ELF file's runpath.
               runtimeLibs = [