Use repo-built Forgejo Namespace services

evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md

@@ -115,7 +115,9 @@ The same change also makes the forge itself the release authority: release tags
   config points at Linux state paths such as `/var/lib/forgejo-runner`.
 - Run forge Namespace services with the repo-owned `nsc` package and keep it
   current with the token format expected by Namespace. `nsc 0.0.520` is the
-  first required baseline for revokable token-file auth.
+  first required baseline for revokable token-file auth. The dispatcher and
+  autoscaler systemd units must also use the repo-built packages so runner fixes
+  ship with Burrow deploys instead of staying pinned to the module input.
 - Render the sealed Namespace runner token with `nsc token create --token_file`
   instead of `nsc auth generate-dev-token`. The dev-token output is for direct
   API/registry access, while the dispatcher needs the JSON token-file format

nixos/hosts/burrow-forge/default.nix

@@ -276,10 +276,12 @@ in
     nscPackage = self.packages.${pkgs.stdenv.hostPlatform.system}.nsc;
     nscTokenFile = config.age.secrets.burrowForgejoNscToken.path;
     dispatcher = {
+      package = self.packages.${pkgs.stdenv.hostPlatform.system}.forgejo-nsc-dispatcher;
       configFile = config.age.secrets.burrowForgejoNscDispatcherConfig.path;
     };
     autoscaler = {
       enable = true;
+      package = self.packages.${pkgs.stdenv.hostPlatform.system}.forgejo-nsc-autoscaler;
       configFile = config.age.secrets.burrowForgejoNscAutoscalerConfig.path;
     };
   };