Point main at the production RadiantWave channel and guard it in CI

The dev->main merge left the channel block in flake.nix pointing at
radiantwave-dev, so prod ISOs built from main shipped the dev app (which
versions itself by short git hash) and the updater polled the dev Attic
manifest. Restore the channel block to main values, re-pin flake.lock to
the latest radiantwave main revision, and expose channelName so the prod
build workflows can fail fast if main ever resolves to the dev channel.

.gitea/workflows/build-prod-android.yml

@@ -17,6 +17,17 @@ jobs:
       - name: Checkout
         run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
 
+      - name: Guard main branch is on the production channel
+        run: |
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          NAME=$(nix eval --impure --raw .#channelName)
+          if [ "$NAME" != "radiantwave" ]; then
+            echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
+            echo "       A dev->main merge brought a dev-pointing channel block into flake.nix."
+            echo "       Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs."
+            exit 1
+          fi
+
       - name: Prepare output directory
         run: mkdir -p /home/user/radiantwave
 

.gitea/workflows/build-prod-commercial.yml

@@ -17,6 +17,17 @@ jobs:
       - name: Checkout
         run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
 
+      - name: Guard main branch is on the production channel
+        run: |
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          NAME=$(nix eval --impure --raw .#channelName)
+          if [ "$NAME" != "radiantwave" ]; then
+            echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
+            echo "       A dev->main merge brought a dev-pointing channel block into flake.nix."
+            echo "       Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs."
+            exit 1
+          fi
+
       - name: Prepare output directory
         run: mkdir -p /home/user/radiantwave
 

.gitea/workflows/build-prod-kiosk.yml

@@ -17,6 +17,17 @@ jobs:
       - name: Checkout
         run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
 
+      - name: Guard main branch is on the production channel
+        run: |
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          NAME=$(nix eval --impure --raw .#channelName)
+          if [ "$NAME" != "radiantwave" ]; then
+            echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
+            echo "       A dev->main merge brought a dev-pointing channel block into flake.nix."
+            echo "       Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs."
+            exit 1
+          fi
+
       - name: Prepare output directory
         run: mkdir -p /home/user/radiantwave
 

.gitea/workflows/build-prod-rpi.yml

@@ -14,6 +14,17 @@ jobs:
       - name: Checkout
         run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
 
+      - name: Guard main branch is on the production channel
+        run: |
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          NAME=$(nix eval --impure --raw .#channelName)
+          if [ "$NAME" != "radiantwave" ]; then
+            echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
+            echo "       A dev->main merge brought a dev-pointing channel block into flake.nix."
+            echo "       Set channel.appInput/atticRepo/gitRef back to main values before building prod images."
+            exit 1
+          fi
+
       - name: Prepare output directory
         run: mkdir -p /home/user/radiantwave