openwrt: Build fergal's firmware in the flake

fergal is an 8-port SFP+ switch on a Realtek RTL9303, running OpenWrt
rather than RouterOS or UniFi. It is not part of the fabric yet, but
its firmware is now built here via astro's nix-openwrt-imagebuilder.
Packages are baked into the image: OpenWrt's package server keeps only
the current build of each feed, so installing at runtime stops working
as soon as the feed moves past the running firmware.

Those feed indexes rotate constantly, and upstream pins only the
indexes -- a mismatch drops evaluation into import-from-derivation,
putting this flake's eval on the network. The openwrt-feeds input pins
expanded per-package hashes instead, in a repository of its own
because they run to hundreds of thousands of generated lines.

Flashing gets a procedure doc and a thin skill pointing at it, the
same split as the box installation and nixpkgs upgrade procedures.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

flake.nix

@@ -58,6 +58,15 @@
     # harmonia.url = "github:devplayer0/harmonia/cache-config-daemon-store";
     harmonia.inputs.nixpkgs.follows = "nixpkgs-unstable";
 
+    # Firmware building for the OpenWrt boxes, which aren't managed by this flake otherwise.
+    # `openwrt-feeds` pins the package feeds; without it, evaluation would reach the OpenWrt
+    # download server over import-from-derivation and break on hashes that upstream rotates daily.
+    openwrt-imagebuilder.url = "github:astro/nix-openwrt-imagebuilder";
+    openwrt-imagebuilder.inputs.nixpkgs.follows = "nixpkgs-unstable";
+    openwrt-feeds.url = "github:devplayer0/openwrt-feeds";
+    openwrt-feeds.inputs.nixpkgs.follows = "nixpkgs-unstable";
+    openwrt-feeds.inputs.openwrt-imagebuilder.follows = "openwrt-imagebuilder";
+
     # Packages not in nixpkgs
     sharry.url = "github:eikek/sharry";
     sharry.inputs.nixpkgs.follows = "nixpkgs-unstable";
@@ -259,7 +268,9 @@
         deploy = recurseIntoAttrs (pkgs.deploy-rs.lib.deployChecks self.deploy);
       };
 
-      packages = flattenTree (import ./pkgs { inherit lib pkgs; });
+      packages = flattenTree (
+        (import ./pkgs { inherit lib pkgs; }) //
+        (import ./openwrt { inherit pkgs inputs; }));
 
       devShells.default = shell;