Pin moved 1.8 tag and guard the baked baseline against the published channel

The radiantwave 1.8 tag was force-moved from 34c72b5 to a5a6b5b while
flake.lock still pinned the old commit, so the ISO baked a baseline that
was not the closure RadiantWave CI published to Attic. With version 1.8
overridden this could still compile RadiantWave from source instead of
substituting it.

- Update flake.lock so radiantwave?ref=refs/tags/1.8 resolves to a5a6b5b.
- Expose channelVersion/channelAtticUrl/channelManifestDir/baselineOutPaths
  from flake.nix for CI verification.
- Prod workflows: fail fast unless channel.appVersion equals the channel
  manifest version, baselineOutPaths.<system> equals the manifest storePath,
  and that store path exists in the channel's Attic cache.

flake.nix

@@ -83,6 +83,21 @@
       # instead of silently shipping dev builds as prod ISOs.
       channelName = if channel.appInput == radiantwave then "radiantwave" else "radiantwave-dev";
 
+      # Channel metadata exposed for CI preflight (see .gitea/workflows/build-*).
+      # `channelVersion` must equal the version RadiantWave CI publishes in the
+      # channel manifest; `baselineOutPaths` must equal the manifest's
+      # `storePath`. When they do, the ISO bakes exactly the closure already in
+      # Attic, so the app is substituted (never compiled locally) and the first
+      # live update is a no-op. A mismatch means either the pinned input is
+      # stale (as when the release tag moves) or channel.appVersion drifted.
+      channelVersion = channel.appVersion;
+      channelAtticUrl = "https://attic.radiantwavetech.com/${channel.atticRepo}";
+      channelManifestDir = "https://files.radiantwavetech.com/${channel.atticRepo}";
+      baselineOutPaths = {
+        x86_64-linux = (appPackage "x86_64-linux").outPath;
+        aarch64-linux = (appPackage "aarch64-linux").outPath;
+      };
+
       # The App package, pinned to the channel's declared version. RadiantWave's
       # own flake only injects its version from the ambient APP_VERSION env var
       # on impure evals; pure evals (local `nix build`, build-rpi.sh) fall back
@@ -224,7 +239,7 @@
         };
     in
     {
-      inherit channelName;
+      inherit channelName channelVersion channelAtticUrl channelManifestDir baselineOutPaths;
 
       packages.x86_64-linux.radiantwavekiosk = self.nixosConfigurations.radiantwavekiosk.config.system.build.toplevel;
       packages.x86_64-linux.radiantwavekiosk-commercial = self.nixosConfigurations.radiantwavekiosk-commercial.config.system.build.toplevel;