fix(n8n): resolve nix-update hash prefetch failure

- Remove --pure from nix-shell shebang to allow network access
- Add --flake --system x86_64-linux for proper flake evaluation
- Navigate to nixpkgs root before running nix-update
- Also bump version 2.17.5 -> 2.17.8

pkgs/n8n/update.sh

@@ -1,8 +1,24 @@
 #!/usr/bin/env nix-shell
-#!nix-shell --pure -i bash -p bash curl jq nix-update cacert git
+#!nix-shell -i bash -p bash curl jq nix-update cacert git nix
 set -euo pipefail
 
 # n8n now publishes two releases per version: a "stable" tag and a "n8n@X.Y.Z" versioned tag.
 # Skip the "stable" tag and get the actual version from the next release.
-new_version="$(curl -s "https://api.github.com/repos/n8n-io/n8n/releases" | jq --raw-output 'map(select(.tag_name != "stable")) | .[0].tag_name | ltrimstr("n8n@")')"
-nix-update n8n --flake --version "$new_version"
+# Note: We removed --pure from the shebang because nix-update needs network access to prefetch hashes.
+
+# Get the directory where this script lives (should be pkgs/n8n/)
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Get the nixpkgs root (parent of pkgs/)
+nixpkgs_root="$(cd "$script_dir/../.." && pwd)"
+
+cd "$nixpkgs_root"
+
+release_info=$(curl -s "https://api.github.com/repos/n8n-io/n8n/releases")
+new_version=$(echo "$release_info" | jq --raw-output 'map(select(.tag_name != "stable")) | .[0].tag_name | ltrimstr("n8n@")')
+
+echo "Latest version: n8n@${new_version}"
+echo "Running from: $(pwd)"
+
+# Use --flake --system to properly evaluate the flake-based package
+nix-update --flake --system x86_64-linux n8n --version "$new_version"