turny: fix SPI/GPIO config for newer kernels

- Add complete config.txt settings with u-boot boot lines + spi=on
- Override sdImage.populateFirmwareCommands to use configtxt module output
- Mount firmware partition and add activation script to sync config.txt
- Load spi_bcm2835 and bcm2835_gpiomem kernel modules
- Add udev rule for gpiomem subsystem (not just gpio)
- Relax ProtectKernelTunables so service can access GPIO
- Update turny flake input to rppal-based CS pin fix

flake.nix

@@ -2,7 +2,8 @@
   inputs = {
     flake-parts.url = "github:hercules-ci/flake-parts";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
+    nixpkgs-25_11.url = "github:NixOS/nixpkgs/nixos-25.11";
     gtrackmap = {
       url = "github:gtrackmap/gtrackmap";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -53,10 +54,6 @@
       inputs.flake-parts.follows = "flake-parts";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    tonearm = {
-      url = "https://codeberg.org/dergs/Tonearm/archive/v1.0.0.tar.gz";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     voidauth = {
       url = "github:repomaa/voidauth/feat/nix-packaging";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
@@ -74,10 +71,7 @@
       url = "github:anomalyco/models.dev";
       flake = false;
     };
-    noctalia = {
-      url = "github:noctalia-dev/noctalia-shell";
-      inputs.nixpkgs.follows = "nixpkgs-unstable";
-    };
+    noctalia.url = "github:noctalia-dev/noctalia";
     niri-flake = {
       url = "github:sodiboo/niri-flake";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
@@ -121,7 +115,6 @@
               packages = with pkgs; [
                 agenix.packages.${system}.default
                 colmena.packages.${system}.colmena
-                colmena.packages.${system}.manual
                 (writeShellScriptBin "build" ''
                   colmena build --keep-result "$@"
                 '')
@@ -131,6 +124,49 @@
                 (writeShellScriptBin "apply-local" ''
                   nh os switch .
                 '')
+                (writeShellScriptBin "build-sd" ''
+                  set -euo pipefail
+
+                  echo "Building SD image for turny..."
+                  nix build .#images.turny --system aarch64-linux --print-build-logs
+
+                  STORE_IMG=$(readlink -f result/sd-image/*.img)
+                  if [ -z "$STORE_IMG" ]; then
+                    echo "Error: No .img file found in result/sd-image/"
+                    exit 1
+                  fi
+
+                  KEY_DIR="$(git rev-parse --show-toplevel)/hosts/turny"
+                  if [ ! -f "$KEY_DIR/ssh_host_ed25519_key" ]; then
+                    echo "Error: SSH host key not found at $KEY_DIR/ssh_host_ed25519_key"
+                    echo "Generate it with: ssh-keygen -t ed25519 -f hosts/turny/ssh_host_ed25519_key -N \"\" -C turny"
+                    exit 1
+                  fi
+
+                  IMG="/tmp/turny-sd-image.img"
+                  echo "Copying image to writable location: $IMG"
+                  cp "$STORE_IMG" "$IMG"
+
+                  echo "Injecting SSH host key into image..."
+                  LOOP=$(sudo losetup --show -P -f "$IMG")
+                  MNT=$(sudo mktemp -d)
+                  cleanup() {
+                    sudo umount "$MNT" 2>/dev/null || true
+                    sudo rmdir "$MNT" 2>/dev/null || true
+                    sudo losetup -d "$LOOP" 2>/dev/null || true
+                  }
+                  trap cleanup EXIT
+
+                  sudo mount "''${LOOP}p2" "$MNT"
+                  sudo mkdir -p "$MNT/etc/ssh"
+                  sudo cp "$KEY_DIR/ssh_host_ed25519_key" "$MNT/etc/ssh/ssh_host_ed25519_key"
+                  sudo cp "$KEY_DIR/ssh_host_ed25519_key.pub" "$MNT/etc/ssh/ssh_host_ed25519_key.pub"
+                  sudo chmod 600 "$MNT/etc/ssh/ssh_host_ed25519_key"
+                  sudo chmod 644 "$MNT/etc/ssh/ssh_host_ed25519_key.pub"
+
+                  echo "Done! Image ready at: $IMG"
+                  echo "Flash with: sudo dd if=$IMG of=/dev/sdX bs=4M conv=fsync status=progress"
+                '')
               ];
             };
           };
@@ -241,4 +277,10 @@
         };
       }
     );
+  nixConfig = {
+    extra-substituters = [ "https://noctalia.cachix.org" ];
+    extra-trusted-public-keys = [
+      "noctalia.cachix.org-1:pCOR47nnMEo5thcxNDtzWpOxNFQsBRglJzxWPp3dkU4="
+    ];
+  };
 }