Consolidate CI into single job

Merge check and build-and-cache into one job to eliminate redundant
nix-setup step. Saves ~1m43s per run.

- PRs: checkout → nix-setup → flake check
- Main pushes: same + build/sign/cache all packages

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -7,7 +7,7 @@ on:
     branches: [main]
 
 jobs:
-  check:
+  ci:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -19,16 +19,8 @@ jobs:
         env:
           NIX_CONFIG: "access-tokens = git.johnogle.info=${{ secrets.GITEA_ACCESS_TOKEN }}"
 
-  build-and-cache:
-    runs-on: ubuntu-latest
-    needs: check
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: https://git.johnogle.info/johno/gitea-actions/nix-setup@v1
-
       - name: Setup SSH for cache
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           mkdir -p ~/.ssh
           echo "${{ secrets.CACHE_SSH_KEY }}" > ~/.ssh/cache_key
@@ -36,11 +28,13 @@ jobs:
           ssh-keyscan -H ${{ secrets.CACHE_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
 
       - name: Setup signing key
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           echo "${{ secrets.NIX_SIGNING_KEY }}" > /tmp/signing-key
           chmod 600 /tmp/signing-key
 
       - name: Build, sign, and cache all packages
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           PACKAGES=(
             custom-claude-code