restructure CI/CD: flake-check gates all deployments

Consolidate 4 separate workflows into 2:

- ci.yml (pull_request): flake-check -> build-hosts
- deploy.yml (push to main): flake-check -> deploy + build-pi-images

Previously, deploy and build-pi-image ran on push to main without
any checks. Now flake-check must pass before anything gets deployed
or built.

.forgejo/workflows/ci.yml

@@ -0,0 +1,36 @@
+name: CI
+
+on: [pull_request]
+
+jobs:
+  flake-check:
+    runs-on: docker
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v27
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+
+      - name: Run flake check
+        run: nix flake check --impure
+
+  build-hosts:
+    needs: flake-check
+    runs-on: docker
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v27
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+
+      - name: Build cryodev-main
+        run: nix build .#nixosConfigurations.cryodev-main.config.system.build.toplevel --impure
+
+      - name: Build cryodev-pi
+        run: nix build .#nixosConfigurations.cryodev-pi.config.system.build.toplevel --impure