feat: add automatic n8n overlay updates

- overlays/mods/n8n.nix: add passthru.updateScript pointing to ./update.sh
- overlays/mods/update.sh: self-contained updater that fetches the latest
  stable n8n-io/n8n release, recomputes both src and pnpmDeps hashes
  (src via nix-prefetch-url with --name workaround for the `@` in the tag,
  pnpmDeps via the lib.fakeHash mismatch trick)
- .gitea/workflows/nix-update.yml: discover and run overlays/mods/*/update.sh
  after the pkgs/ loop; verify step skips overlay/* entries (covered by flake check)

The test suite (tests/n8n-overlay-test.nix) forbids exporting a local n8n
package, so the overlay cannot be exposed via pkgs/n8n/ — the workflow gets
an explicit overlay-discovery block instead.

.gitea/workflows/nix-update.yml

@@ -352,6 +352,47 @@ jobs:
             done
           fi
 
+          # ── Update overlay modifications (overlays/mods/) ───────────────
+          # Overlay updates live outside pkgs/ because the test suite
+          # (tests/n8n-overlay-test.nix) forbids exporting the overlay target
+          # as a local package. Each `overlays/mods/*/update.sh` or
+          # `overlays/mods/update.sh` is a self-contained updater that handles
+          # version discovery, hash recomputation, and commit on its own.
+          if [ -z "${{ inputs.package }}" ]; then
+            echo ""
+            echo "🔍 Discovering overlay update scripts in overlays/mods/ ..."
+            OVERLAY_SCRIPTS=$(find overlays/mods -maxdepth 2 -name "update.sh" 2>/dev/null | sort)
+
+            if [ -n "$OVERLAY_SCRIPTS" ]; then
+              for script in $OVERLAY_SCRIPTS; do
+                OVERLAY_NAME=$(basename "$(dirname "$script")")
+                echo "::group::Updating overlay: $OVERLAY_NAME"
+                BEFORE_HASH=$(git rev-parse HEAD)
+
+                # Overlay scripts are self-contained and use nix-shell shebangs
+                # for their dependencies. They commit on their own.
+                if bash "$script" 2>&1 | tee /tmp/update-overlay-${OVERLAY_NAME}.log; then
+                  if [ "$(git rev-parse HEAD)" != "$BEFORE_HASH" ]; then
+                    echo "✅ Updated overlay/$OVERLAY_NAME"
+                    UPDATES_FOUND=true
+                    if [ -n "$UPDATED_PACKAGES" ]; then
+                      UPDATED_PACKAGES="$UPDATED_PACKAGES, overlay/$OVERLAY_NAME"
+                    else
+                      UPDATED_PACKAGES="overlay/$OVERLAY_NAME"
+                    fi
+                  else
+                    echo "✓ overlay/$OVERLAY_NAME already up to date"
+                  fi
+                else
+                  echo "⚠️ Update failed for overlay/$OVERLAY_NAME"
+                fi
+                echo "::endgroup::"
+              done
+            else
+              echo "ℹ️ No overlay update scripts found."
+            fi
+          fi
+
           COMMIT_COUNT=$(git rev-list --count origin/master..HEAD)
 
           if [ "$COMMIT_COUNT" -gt 0 ]; then
@@ -382,6 +423,12 @@ jobs:
           SUCCESSFUL_PACKAGES=()
 
           for pkg in "${PKGS[@]}"; do
+            # Overlay updates (e.g. "overlay/n8n") have no top-level flake
+            # attribute — `nix flake check` already verifies them above.
+            if [[ "$pkg" == overlay/* ]]; then
+              echo "⊘ Skipping per-package build for $pkg (verified via flake check)"
+              continue
+            fi
             echo "::group::Building $pkg"
             if nix build .#$pkg 2>&1 | tee /tmp/build-${pkg}.log; then
               echo "✅ Build successful for $pkg"