Point main at the production RadiantWave channel and guard it in CI

The dev->main merge left the channel block in flake.nix pointing at
radiantwave-dev, so prod ISOs built from main shipped the dev app (which
versions itself by short git hash) and the updater polled the dev Attic
manifest. Restore the channel block to main values, re-pin flake.lock to
the latest radiantwave main revision, and expose channelName so the prod
build workflows can fail fast if main ever resolves to the dev channel.

.gitea/workflows/build-prod-android.yml

@@ -17,6 +17,17 @@ jobs:
       - name: Checkout
         run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
 
+      - name: Guard main branch is on the production channel
+        run: |
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          NAME=$(nix eval --impure --raw .#channelName)
+          if [ "$NAME" != "radiantwave" ]; then
+            echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
+            echo "       A dev->main merge brought a dev-pointing channel block into flake.nix."
+            echo "       Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs."
+            exit 1
+          fi
+
       - name: Prepare output directory
         run: mkdir -p /home/user/radiantwave
 

.gitea/workflows/build-prod-commercial.yml

@@ -17,6 +17,17 @@ jobs:
       - name: Checkout
         run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
 
+      - name: Guard main branch is on the production channel
+        run: |
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          NAME=$(nix eval --impure --raw .#channelName)
+          if [ "$NAME" != "radiantwave" ]; then
+            echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
+            echo "       A dev->main merge brought a dev-pointing channel block into flake.nix."
+            echo "       Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs."
+            exit 1
+          fi
+
       - name: Prepare output directory
         run: mkdir -p /home/user/radiantwave
 

.gitea/workflows/build-prod-kiosk.yml

@@ -17,6 +17,17 @@ jobs:
       - name: Checkout
         run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
 
+      - name: Guard main branch is on the production channel
+        run: |
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          NAME=$(nix eval --impure --raw .#channelName)
+          if [ "$NAME" != "radiantwave" ]; then
+            echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
+            echo "       A dev->main merge brought a dev-pointing channel block into flake.nix."
+            echo "       Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs."
+            exit 1
+          fi
+
       - name: Prepare output directory
         run: mkdir -p /home/user/radiantwave
 

.gitea/workflows/build-prod-rpi.yml

@@ -14,6 +14,17 @@ jobs:
       - name: Checkout
         run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
 
+      - name: Guard main branch is on the production channel
+        run: |
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          NAME=$(nix eval --impure --raw .#channelName)
+          if [ "$NAME" != "radiantwave" ]; then
+            echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
+            echo "       A dev->main merge brought a dev-pointing channel block into flake.nix."
+            echo "       Set channel.appInput/atticRepo/gitRef back to main values before building prod images."
+            exit 1
+          fi
+
       - name: Prepare output directory
         run: mkdir -p /home/user/radiantwave
 

flake.lock

@@ -220,11 +220,11 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1787675420,
+        "lastModified": 1787953913,
-        "narHash": "sha256-2Hq9IcgdDXQc2uQ4yC/5NZVjcZaFCcVS78vj+ee+y/Q=",
+        "narHash": "sha256-6M0xyNIwhGiOiOyS+URYzhKdV69fRgifXYqoGmHrmaY=",
         "ref": "main",
-        "rev": "43cd93bbd7dde69c55c00a28c1691e1a192eda39",
+        "rev": "fee31c87b8ece4bb025e7ec10aed03c9794e2143",
-        "revCount": 47,
+        "revCount": 56,
         "type": "git",
         "url": "https://gitea.radiantwavetech.com/RadiantWaveTech/radiantwave.git"
       },

flake.nix

@@ -68,11 +68,19 @@
       #
       # To flip branches, change ONLY these three values (then push/merge).
       channel = {
-        appInput = radiantwave-dev;                                    # dev
+        appInput = radiantwave;                                        # main
-        atticRepo = "radiantwave-dev";                                 # dev
+        atticRepo = "radiantwave";                                     # main
-        gitRef = "?ref=dev";                                           # dev
+        gitRef = "";                                                   # main
       };
 
+      # Exposed so CI (see .gitea/workflows/build-prod-*.yml) and humans can
+      # verify which channel this checkout resolves to. On `main` this must be
+      # "radiantwave"; on `dev` it must be "radiantwave-dev". The prod
+      # workflows fail fast if this isn't the production channel, so a merge
+      # that brings a dev-pointing channel block into `main` breaks the build
+      # instead of silently shipping dev builds as prod ISOs.
+      channelName = if channel.appInput == radiantwave then "radiantwave" else "radiantwave-dev";
+
       # Live app-update side channel. The manifest is served by the
       # fileserver; closures are fetched (never built) from the channel's
       # Attic cache. `repo` selects the channel — "radiantwave" (main) or
@@ -200,6 +208,8 @@
         };
     in
     {
+      inherit channelName;
+
       packages.x86_64-linux.radiantwavekiosk = self.nixosConfigurations.radiantwavekiosk.config.system.build.toplevel;
       packages.x86_64-linux.radiantwavekiosk-commercial = self.nixosConfigurations.radiantwavekiosk-commercial.config.system.build.toplevel;
       packages.x86_64-linux.radiantwavekiosk-android = self.nixosConfigurations.radiantwavekiosk-android.config.system.build.toplevel;