restructure CI/CD: flake-check gates all deployments

Consolidate 4 separate workflows into 2:

- ci.yml (pull_request): flake-check -> build-hosts
- deploy.yml (push to main): flake-check -> deploy + build-pi-images

Previously, deploy and build-pi-image ran on push to main without
any checks. Now flake-check must pass before anything gets deployed
or built.

.forgejo/workflows/build-hosts.yml

@@ -1,24 +0,0 @@
-name: Build hosts
-
-on:
-  pull_request:
-    branches:
-      - main
-
-jobs:
-  build-hosts:
-    runs-on: docker
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@v27
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
-
-      - name: Build cryodev-main
-        run: nix build .#nixosConfigurations.cryodev-main.config.system.build.toplevel --impure
-
-      - name: Build cryodev-pi
-        run: nix build .#nixosConfigurations.cryodev-pi.config.system.build.toplevel --impure