chore(packages): bump packages to latest upstream versions

Update every package to its newest upstream release/commit:
- aionui 2.1.50 -> 2.2.2
- awg-tool 0.2.2 -> 0.3.0
- ds4 -> 0-unstable-2026-09-12
- freebuff 0.0.142 -> 0.0.174
- graphify 0.9.35 -> 0.9.61
- hipengine 0.3.0 -> 0.5.0
- mcp-gateway 3.4.0 -> 3.5.1
- omniroute 3.8.49 -> 3.8.50
- radar 1.9.1 -> 1.13.1
- relay-free-llm -> 0-unstable-2026-08-31
- traycer 1.1.10 -> 1.3.0

Refresh all source/dependency hashes (src, cargoHash, vendorHash,
npmDepsHash, bun FODs) and keep treefmt clean.

Packaging fixes required by the bumps:
- graphify: relax the setuptools>=83 build-backend pin (nixpkgs ships
  setuptools 80.x; the PEP 639 metadata needs only >=77).
- hipengine: add a llguidance 1.8.0 override (nixpkgs ships 1.7.x).
- omniroute: use npmDepsFetcherVersion 2; the v1 fetcher drops packages
  whose lockfile entries lack resolved URLs, breaking npm's cache check.
- radar: fix a frontend npmDepsHash/vendorHash swap from nix-update.

Packages already at latest are untouched: container-use, desloppify,
freetoken, kubernetes-mcp-server, loop, nftables-analyzer,
nftablesbuilder, stakpak, haivemind, skillsmcp. llama-cpp stays pinned
at b9645 and is tracked separately (manual HIP flag re-validation).

packages/omniroute/package.nix

@@ -8,10 +8,10 @@
 }:
 
 let
-  version = "3.8.49";
+  version = "3.8.50";
   npmTarball = fetchurl {
     url = "https://registry.npmjs.org/omniroute/-/omniroute-${version}.tgz";
-    hash = "sha256-fcGsAxOdv1ZSwt24eHJu97lyRATKBw8rYeFvGTRhxYs=";
+    hash = "sha256-c4xYrx+q6MV+tkOpOdEZH41+CD2Sle9haH0r/wSHjCk=";
   };
 in
 
@@ -23,12 +23,16 @@ buildNpmPackage (finalAttrs: {
     owner = "diegosouzapw";
     repo = "OmniRoute";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-nRLziV4NWPoa0ev57DV7jmAvLpL/1MP1EMZO2/drrTU=";
+    hash = "sha256-+2FMc9wrvPtQS3+mGsBVvKrd5RprYe/r/GJvjAVMBpc=";
   };
 
   nodejs = nodejs_22;
 
-  npmDepsHash = "sha256-R0u93MLUUWC8xFgq4S0Aj/7wg4pygTKwxP/eWkWMgCw=";
+  # Upstream's package-lock omits `resolved` URLs for some entries, which the
+  # v1 fetcher drops from the cache (npm then fails with ENOTCACHED).
+  npmDepsFetcherVersion = 2;
+
+  npmDepsHash = "sha256-wa5vQMYugA8E7lXOh4lgNH7JNbKOinNaW6Zk8Mw2e8k=";
 
   # Skip Next.js build (requires network for Google Fonts).
   # Pre-built dist/ is copied from the npm tarball in preConfigure.