restructure CI/CD: flake-check gates all deployments

Consolidate 4 separate workflows into 2:

- ci.yml (pull_request): flake-check -> build-hosts
- deploy.yml (push to main): flake-check -> deploy + build-pi-images

Previously, deploy and build-pi-image ran on push to main without
any checks. Now flake-check must pass before anything gets deployed
or built.

.forgejo/workflows/ci.yml

@@ -1,12 +1,24 @@
-name: Build hosts
+name: CI
 
-on:
+on: [pull_request]
-  pull_request:
-    branches:
-      - main
 
 jobs:
+  flake-check:
+    runs-on: docker
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v27
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+
+      - name: Run flake check
+        run: nix flake check --impure
+
   build-hosts:
+    needs: flake-check
     runs-on: docker
     steps:
       - name: Checkout repository

.forgejo/workflows/deploy-main.yml

@@ -1,34 +0,0 @@
-name: Deploy cryodev-main
-
-on:
-  push:
-    branches:
-      - main
-
-jobs:
-  deploy-cryodev-main:
-    runs-on: docker
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@v27
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
-
-      - name: Set up SSH
-        env:
-          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
-        run: |
-          mkdir -p ~/.ssh
-          echo "$DEPLOY_KEY" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-          
-          # Add host key (replace with actual host key or use ssh-keyscan in unsafe environments)
-          ssh-keyscan -H cryodev.xyz >> ~/.ssh/known_hosts
-
-      - name: Deploy with deploy-rs
-        run: |
-          # Deploy using deploy-rs
-          nix run github:serokell/deploy-rs -- -s .#cryodev-main

.forgejo/workflows/deploy.yml

@@ -1,27 +1,56 @@
-name: Build Raspberry Pi SD Images
+name: Deploy
 
 on:
   push:
     branches:
       - main
-    paths:
-      - 'hosts/**'
-      - 'modules/**'
-      - 'templates/**'
-      - 'flake.nix'
-      - 'flake.lock'
-      - 'constants.nix'
-  workflow_dispatch:
 
 jobs:
+  flake-check:
+    runs-on: docker
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v27
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+
+      - name: Run flake check
+        run: nix flake check --impure
+
+  deploy-cryodev-main:
+    needs: flake-check
+    runs-on: docker
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v27
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+
+      - name: Set up SSH
+        env:
+          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$DEPLOY_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H cryodev.xyz >> ~/.ssh/known_hosts
+
+      - name: Deploy with deploy-rs
+        run: nix run github:serokell/deploy-rs -- -s .#cryodev-main
+
   build-pi-images:
+    needs: flake-check
     runs-on: host
     strategy:
       matrix:
-        # Add new Pi hosts to this list when created
         host: [cryodev-pi]
       fail-fast: false
-    
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -29,21 +58,19 @@ jobs:
       - name: Build SD image for ${{ matrix.host }}
         run: |
           echo "Building SD image for: ${{ matrix.host }}"
-          echo "This may take 30-60 minutes with emulation..."
-          
           nix build .#nixosConfigurations.${{ matrix.host }}.config.system.build.sdImage \
             --extra-platforms aarch64-linux \
             --out-link result-${{ matrix.host }}
-          
+
           IMAGE_PATH=$(find result-${{ matrix.host }} -name "*.img.zst" -type f | head -1)
           if [ -z "$IMAGE_PATH" ]; then
             echo "Error: No image found!"
             exit 1
           fi
-          
+
           cp "$IMAGE_PATH" ./${{ matrix.host }}-sd-image.img.zst
           sha256sum ${{ matrix.host }}-sd-image.img.zst > ${{ matrix.host }}-sd-image.img.zst.sha256
-          
+
           echo "Image size:"
           ls -lh ${{ matrix.host }}-sd-image.img.zst
 
@@ -72,19 +99,17 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           VERSION="v$(date +%Y-%m-%d)-$(git rev-parse --short HEAD)"
-          
+
-          # Create release via API
           curl -s -X POST \
             -H "Authorization: token ${GITHUB_TOKEN}" \
             -H "Content-Type: application/json" \
             -d "{\"tag_name\": \"${VERSION}\", \"name\": \"Pi Images ${VERSION}\", \"body\": \"Raspberry Pi SD card images. See docs for usage.\", \"draft\": false, \"prerelease\": false}" \
             "https://git.cryodev.xyz/api/v1/repos/${GITHUB_REPOSITORY}/releases" \
             -o release.json
-          
+
           RELEASE_ID=$(jq -r '.id' release.json)
           echo "Release ID: $RELEASE_ID"
-          
+
-          # Upload all files
           for file in $(find artifacts -type f); do
             echo "Uploading: $(basename $file)"
             curl -s -X POST \
@@ -93,5 +118,5 @@ jobs:
               --data-binary @"$file" \
               "https://git.cryodev.xyz/api/v1/repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}/assets?name=$(basename $file)"
           done
-          
+
           echo "Done: https://git.cryodev.xyz/${GITHUB_REPOSITORY}/releases/tag/${VERSION}"

.forgejo/workflows/flake-check.yml

@@ -1,18 +0,0 @@
-name: Flake check
-
-on: [pull_request]
-
-jobs:
-  flake-check:
-    runs-on: docker
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@v27
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
-
-      - name: Run flake check
-        run: nix flake check --impure