fix: build with zola 0.23 via anemone's tera-v2 migration

[stackptr]

Summary

• The nixpkgs bump that landed a few weeks ago pulled in zola 0.23.4, described upstream as "probably the most breaking version of Zola that will happen" — it removed shortcodes and migrated Tera to v2.
• The anemone theme wasn't updated for it: building failed with Unknown filter 'escape' and Block 'head' is not defined in any parent template.
• In the Nix sandbox, that real error was masked by an earlier one: zola 0.23 also dropped its native-tls fallback, so its now-mandatory rustls client panics building a client without a CA bundle (No CA certificates were loaded from the system), since the sandbox has no /etc/ssl/certs and nothing sets SSL_CERT_FILE. That's the error that surfaced in stackptr/rc's CI (PR #553).
• Speyll/anemone#41 migrates the theme for zola 0.23/Tera v2 but hasn't merged yet, so this pins anemone directly to that branch. It adds a head block to the theme's own base.html for per-page SEO tags — but this site overrides base.html with its own, so the same block was added here too.
• Also dropped x86_64-darwin from systems: nixpkgs 26.11 (needed for zola 0.23) dropped support for it entirely, which broke nix build/nix flake check outright once nixpkgs was bumped (flake-parts evaluates formatter for every declared system regardless of which one is requested).
• Once #41 merges upstream, swap the anemone input back to Speyll/anemone.

Test plan

• nix flake check passes
• nix build succeeds
• Diffed rendered output against the last known-good build (zola 0.22.1) — only difference is cosmetic (/ vs / escaping from Tera v2's new autoescape rules); the per-page SEO JSON-LD schema (previously silently broken since the site's base.html never defined a head block) now renders correctly
• nix fmt . — no changes needed