Restore separate check job for better CI UX

- PRs: Fast flake check with clear status
- Main: check → build-and-cache (build only starts if check passes)
- Clearer failure attribution and status badges

Tradeoff: 2x nix-setup on main pushes, but better job structure.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -7,7 +7,7 @@ on:
     branches: [main]
 
 jobs:
-  ci:
+  check:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -19,8 +19,16 @@ jobs:
         env:
           NIX_CONFIG: "access-tokens = git.johnogle.info=${{ secrets.GITEA_ACCESS_TOKEN }}"
 
-      - name: Setup SSH for cache
+  build-and-cache:
+    runs-on: ubuntu-latest
+    needs: check
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: https://git.johnogle.info/johno/gitea-actions/nix-setup@v1
+
+      - name: Setup SSH for cache
         run: |
           mkdir -p ~/.ssh
           echo "${{ secrets.CACHE_SSH_KEY }}" > ~/.ssh/cache_key
@@ -28,13 +36,11 @@ jobs:
           ssh-keyscan -H ${{ secrets.CACHE_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
 
       - name: Setup signing key
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           echo "${{ secrets.NIX_SIGNING_KEY }}" > /tmp/signing-key
           chmod 600 /tmp/signing-key
 
       - name: Build, sign, and cache all packages
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           PACKAGES=(
             custom-claude-code