feat: add deploy-rs for automated NixOS deployments

[stackptr]

Summary

• Adds deploy-rs as a flake input with deploy nodes for glyph, spore, and zeta
• Creates a GitHub Actions deploy workflow that runs after CI passes on main (also supports manual dispatch)
• Adds a dedicated deploy SSH key authorized for root on all NixOS hosts
• Uses Tailscale GitHub Action for ephemeral tailnet connectivity from GHA runners
• Builds on GHA runners with Attic cache (remoteBuild = false), avoiding spore's memory constraints
• Magic rollback enabled by default for safe activations

Required setup before merging

• Add GitHub secret DEPLOY_SSH_KEY (ed25519 private key)
• Add GitHub secrets TS_OAUTH_CLIENT_ID and TS_OAUTH_SECRET (Tailscale OAuth client)
• Deploy the SSH key to hosts first (the keys.deploy change in ssh.nix needs to be applied manually to at least one host before the first automated deploy)

Test plan

• Verify nix flake check passes in CI
• Verify nix eval .#deploy.nodes returns all three hosts
• After secrets are configured, trigger a manual workflow_dispatch deploy
• Confirm each host receives the new generation and activation succeeds
• Verify magic rollback works by testing with a deliberately broken config (optional)

🤖 Generated with Claude Code