The previous jq filter grabbed the first non-stable release by creation date,
which incorrectly returned 1.123.38 instead of the latest stable 2.18.5.
Now query the 'stable' tag directly and extract version from its
target_commitish (e.g., 'release/2.18.5' -> '2.18.5'), ensuring we always
get the actual latest stable version.
Also bump version from 2.17.8 to 2.18.5 with updated hashes.
- Remove --pure from nix-shell shebang to allow network access
- Add --flake --system x86_64-linux for proper flake evaluation
- Navigate to nixpkgs root before running nix-update
- Also bump version 2.17.5 -> 2.17.8
