fix: add pipewire config closure to sound service confinement

The /etc/pipewire directory contains symlinks to the
pipewire-extra-config store path, which isn't in the confinement
closure. Add the pipewire config source to confinement.packages so
its full closure is available in the namespace.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

modules/services.nix

@@ -563,6 +563,7 @@ in
               confinement = {
                 enable = true;
                 binSh = null;
+                packages = [ config.environment.etc.pipewire.source ];
               };
 
               serviceConfig = {