openwrt: Pin vendored feed indexes

Pin `openwrt-feeds` to repository state that includes vendored APK
indexes, keeping image builds independent of mutable upstream indexes.

Document the corresponding refresh workflow.

docs/deployment.md

@@ -202,11 +202,14 @@ point release. Building straight against it fails on hash mismatches and, worse,
 package list by import-from-derivation — which would drag *evaluation* of this flake onto the
 network and let an OpenWrt feed rebuild break `check-system` for unrelated boxes.
 
-The `openwrt-feeds` input exists to stop that. It holds expanded per-package hashes, so every `.apk`
+The `openwrt-feeds` input exists to stop that. It holds expanded per-package metadata and vendors
-is a plain pinned `fetchurl` and no import-from-derivation is involved. Its generated files run to
+the repository indexes themselves, so every `.apk` is a plain pinned `fetchurl`, image builds read
-hundreds of thousands of lines and are rewritten wholesale on each refresh, which is why they live
+the indexes from the flake rather than OpenWrt's mutable URLs, and no import-from-derivation is
-in their own repository rather than here. Refresh the pin with `nix flake update openwrt-feeds`;
+involved. Its generated files run to hundreds of thousands of lines and are rewritten wholesale on
-adding a release or target means adding it to that repo's `pins` and regenerating there first.
+each refresh, which is why they live in their own repository rather than here. Regenerate and push
+that repository with `nix run .#update`, then refresh this flake's pin with
+`nix flake update openwrt-feeds`; adding a release or target means adding it to that repository's
+`pins` first.
 
 ## CI
 

flake.lock

@@ -941,11 +941,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1787353688,
+        "lastModified": 1787522666,
-        "narHash": "sha256-YDEm+ev3BpDS9Sq1ByVv0i5QQCE1yezpjWVhcNBBjCE=",
+        "narHash": "sha256-Ev4X1HCx6aV4L5GtMQX9DJRgWQ7K914rT11nL7mIkmw=",
         "owner": "devplayer0",
         "repo": "openwrt-feeds",
-        "rev": "a30b2b5f83c7d1fffca2146453e8d5866b882da4",
+        "rev": "53720becf1e89473660e25107ae5d23bf1465621",
         "type": "github"
       },
       "original": {