Fix attic verify: fetch deps from cache.nixos.org

The verify step fetched the closure from Attic alone, but Attic's
upstream-cache filter (cache.nixos.org-1) intentionally skips nixpkgs deps
like sqlite, so `nix copy` failed on 'path is not valid'. Mirror the kiosk
updater and fetch from Attic + cache.nixos.org together, Attic first so a
truncated RadiantWave NAR still fails before the manifest is published.

.gitea/workflows/dev.yml

@@ -67,6 +67,26 @@ jobs:
           attic login radiantwave https://attic.radiantwavetech.com "$ATTIC_TOKEN"
           attic push radiantwave:radiantwave-dev ./result-pkg
 
+      # attic push can exit 0 while storing a truncated NAR (dropped
+      # connection, disk full on the attic host), which kiosks then fail to
+      # fetch. Re-fetch the whole closure into a throwaway store to verify
+      # every NAR; if the upload is incomplete, `nix-store -r` errors and the
+      # manifest below is never published.
+      #
+      # NOTE: Attic's upstream-cache filter (upstream_cache_key_names =
+      # cache.nixos.org-1) intentionally skips re-uploading nixpkgs deps
+      # (e.g. sqlite) that are already signed by cache.nixos.org, so this must
+      # fetch from Attic AND cache.nixos.org together, exactly like the kiosk
+      # updater does. Attic stays the primary source (it's listed first, so a
+      # truncated RadiantWave NAR still fails here).
+      - name: Verify Attic upload
+        run: |
+          nix-store -r "$(readlink -f ./result-pkg)" \
+            --store "$PWD/.attic-verify-store" \
+            --option require-sigs false \
+            --option substituters "https://attic.radiantwavetech.com/radiantwave-dev https://cache.nixos.org"
+          rm -rf "$PWD/.attic-verify-store"
+
       # Publish the manifest kiosks poll for live app updates. `storePath`
       # must match exactly the closure pushed to the dev Attic cache above
       # (readlink resolves the result-pkg out-link symlink to its real

.gitea/workflows/main.yml

@@ -75,6 +75,26 @@ jobs:
           attic login radiantwave https://attic.radiantwavetech.com "$ATTIC_TOKEN"
           attic push radiantwave:radiantwave ./result-pkg
 
+      # attic push can exit 0 while storing a truncated NAR (dropped
+      # connection, disk full on the attic host), which kiosks then fail to
+      # fetch. Re-fetch the whole closure into a throwaway store to verify
+      # every NAR; if the upload is incomplete, `nix-store -r` errors and the
+      # manifest below is never published.
+      #
+      # NOTE: Attic's upstream-cache filter (upstream_cache_key_names =
+      # cache.nixos.org-1) intentionally skips re-uploading nixpkgs deps
+      # (e.g. sqlite) that are already signed by cache.nixos.org, so this must
+      # fetch from Attic AND cache.nixos.org together, exactly like the kiosk
+      # updater does. Attic stays the primary source (it's listed first, so a
+      # truncated RadiantWave NAR still fails here).
+      - name: Verify Attic upload
+        run: |
+          nix-store -r "$(readlink -f ./result-pkg)" \
+            --store "$PWD/.attic-verify-store" \
+            --option require-sigs false \
+            --option substituters "https://attic.radiantwavetech.com/radiantwave https://cache.nixos.org"
+          rm -rf "$PWD/.attic-verify-store"
+
       # Publish the manifest production kiosks poll for live app updates.
       # `storePath` must match exactly the closure pushed to the release Attic
       # cache above (readlink resolves the result-pkg out-link symlink to its