Keep checked browser runtime versions independent of authority upgrades

restricted-execution/workerd.nix

@@ -1,5 +1,6 @@
 # Pinned upstream engine. This binary supplies an import/capability boundary;
-# production execution additionally requires a workspace VM and OS limits.
+# production execution additionally requires OS limits and platform approval
+# for shared placement, or a workspace VM for unreviewed application code.
 { pkgs }:
 let
   version = "1.20261005.1";
@@ -37,7 +38,7 @@ pkgs.stdenvNoCC.mkDerivation {
     "$out/bin/workerd" --version | grep -Fx 'workerd 2026-10-05'
   '';
   meta = {
-    description = "Pinned workerd engine for VM-scoped Quixos restricted execution";
+    description = "Pinned workerd engine for Quixos restricted execution";
     homepage = "https://github.com/cloudflare/workerd";
     license = pkgs.lib.licenses.asl20;
     platforms = builtins.attrNames platforms;