Fix attic verify: fetch deps from cache.nixos.org

The verify step fetched the closure from Attic alone, but Attic's
upstream-cache filter (cache.nixos.org-1) intentionally skips nixpkgs deps
like sqlite, so `nix copy` failed on 'path is not valid'. Mirror the kiosk
updater and fetch from Attic + cache.nixos.org together, Attic first so a
truncated RadiantWave NAR still fails before the manifest is published.

.gitea/workflows/dev.yml

@@ -70,15 +70,21 @@ jobs:
       # attic push can exit 0 while storing a truncated NAR (dropped
       # connection, disk full on the attic host), which kiosks then fail to
       # fetch. Re-fetch the whole closure into a throwaway store to verify
-      # every NAR; if the upload is incomplete, `nix copy` errors and the
+      # every NAR; if the upload is incomplete, `nix-store -r` errors and the
       # manifest below is never published.
+      #
+      # NOTE: Attic's upstream-cache filter (upstream_cache_key_names =
+      # cache.nixos.org-1) intentionally skips re-uploading nixpkgs deps
+      # (e.g. sqlite) that are already signed by cache.nixos.org, so this must
+      # fetch from Attic AND cache.nixos.org together, exactly like the kiosk
+      # updater does. Attic stays the primary source (it's listed first, so a
+      # truncated RadiantWave NAR still fails here).
       - name: Verify Attic upload
         run: |
-          nix copy \
-            --from "https://attic.radiantwavetech.com/radiantwave-dev" \
-            --to "$PWD/.attic-verify-store" \
-            --no-check-sigs \
-            "$(readlink -f ./result-pkg)"
+          nix-store -r "$(readlink -f ./result-pkg)" \
+            --store "$PWD/.attic-verify-store" \
+            --option require-sigs false \
+            --option substituters "https://attic.radiantwavetech.com/radiantwave-dev https://cache.nixos.org"
           rm -rf "$PWD/.attic-verify-store"
 
       # Publish the manifest kiosks poll for live app updates. `storePath`

.gitea/workflows/main.yml

@@ -78,15 +78,21 @@ jobs:
       # attic push can exit 0 while storing a truncated NAR (dropped
       # connection, disk full on the attic host), which kiosks then fail to
       # fetch. Re-fetch the whole closure into a throwaway store to verify
-      # every NAR; if the upload is incomplete, `nix copy` errors and the
+      # every NAR; if the upload is incomplete, `nix-store -r` errors and the
       # manifest below is never published.
+      #
+      # NOTE: Attic's upstream-cache filter (upstream_cache_key_names =
+      # cache.nixos.org-1) intentionally skips re-uploading nixpkgs deps
+      # (e.g. sqlite) that are already signed by cache.nixos.org, so this must
+      # fetch from Attic AND cache.nixos.org together, exactly like the kiosk
+      # updater does. Attic stays the primary source (it's listed first, so a
+      # truncated RadiantWave NAR still fails here).
       - name: Verify Attic upload
         run: |
-          nix copy \
-            --from "https://attic.radiantwavetech.com/radiantwave" \
-            --to "$PWD/.attic-verify-store" \
-            --no-check-sigs \
-            "$(readlink -f ./result-pkg)"
+          nix-store -r "$(readlink -f ./result-pkg)" \
+            --store "$PWD/.attic-verify-store" \
+            --option require-sigs false \
+            --option substituters "https://attic.radiantwavetech.com/radiantwave https://cache.nixos.org"
           rm -rf "$PWD/.attic-verify-store"
 
       # Publish the manifest production kiosks poll for live app updates.