fix: narrow shared filter to avoid matching host-specific secrets

Replace lib/** with lib/* to match only top-level lib files, and
explicitly list shared secret files instead of using negation patterns
which don't work as overrides in dorny/paths-filter. Also add
secrets/** for top-level shared secrets.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: stackptr

.github/workflows/deploy.yml

@@ -52,12 +52,12 @@ jobs:
             shared:
               - 'modules/**'
               - 'home/**'
-              - 'lib/**'
-              - '!lib/secrets/glyph.nix'
-              - '!lib/secrets/spore.nix'
-              - '!lib/secrets/zeta.nix'
+              - 'lib/*'
+              - 'lib/secrets/default.nix'
+              - 'lib/secrets/home.nix'
               - 'overlays/**'
               - 'packages/**'
+              - 'secrets/**'
               - 'flake.nix'
               - 'flake.lock'