Fail evaluation once rainix nixpkgs cacert catches up with the pin

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: rain-marvin[bot]

os.nix

@@ -197,6 +197,13 @@ in
       "ssl/trust-source".source = lib.mkForce "${cacert.p11kit}/etc/ssl/trust-source";
     };
 
+  assertions = [
+    {
+      assertion = lib.versionOlder pkgs.cacert.version cacert.version;
+      message = "rainix nixpkgs cacert ${pkgs.cacert.version} has caught up with the pinned cacert ${cacert.version}; remove the nixpkgs-cacert input, the /etc CA overrides and the nix-daemon CURL_CA_BUNDLE override.";
+    }
+  ];
+
   networking.firewall = {
     enable = true;
     allowedTCPPorts = [