fixup: stateVersion 26.05, drop ubuntu labels, simplify CI workflow

- stateVersion: 25.11 → 26.05 (match hive-gateway + hive-matrix)
- default labels: drop ubuntu-latest/ubuntu-22.04 aliases — misleading
  since this isn't Ubuntu; hive-ci:host is the correct label
- ci.yml: collapse to single `nix flake check` job — flake checks.* already
  covers formatting (treefmt+rustfmt), cargo test, and clippy

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -13,30 +13,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: check
-        run: nix flake check --no-build
-
-  fmt:
-    name: formatting
-    runs-on: [hive-ci]
-    steps:
-      - uses: actions/checkout@v3
-      - name: nix fmt
-        run: nix fmt -- --check .
-      - name: cargo fmt
-        run: cargo fmt --all -- --check
-
-  test:
-    name: cargo test
-    runs-on: [hive-ci]
-    steps:
-      - uses: actions/checkout@v3
-      - name: test
-        run: cargo test --workspace
-
-  clippy:
-    name: cargo clippy
-    runs-on: [hive-ci]
-    steps:
-      - uses: actions/checkout@v3
-      - name: clippy
-        run: cargo clippy --workspace -- -D warnings
+        # Runs all flake checks: formatting (treefmt+rustfmt), cargo test,
+        # cargo clippy, and module evaluation. No --no-build: the checks
+        # derivations are the canonical source of truth.
+        run: nix flake check

nix/modules/hive-ci.nix

@@ -115,11 +115,7 @@ in
 
     labels = lib.mkOption {
       type = lib.types.listOf lib.types.str;
-      default = [
-        "hive-ci:host"
-        "ubuntu-latest:host"
-        "ubuntu-22.04:host"
-      ];
+      default = [ "hive-ci:host" ];
       example = [
         "hive-ci:host"
         "nix:host"
@@ -128,10 +124,6 @@ in
         Runner labels in `<name>:<scheme>` format. The `host` scheme runs
         commands directly in the container (no docker/podman). Workflow
         files target this runner with `runs-on: [hive-ci]`.
-
-        The `ubuntu-latest` and `ubuntu-22.04` aliases let workflow files
-        that hardcode GitHub-style runner names work unchanged, as long as
-        those jobs only need git + nix + cargo and not Ubuntu APT packages.
       '';
     };
 
@@ -173,7 +165,7 @@ in
       config =
         { pkgs, lib, ... }:
         {
-          system.stateVersion = "25.11";
+          system.stateVersion = "26.05";
 
           # nspawn containers can't create user-namespaces, so nix
           # sandboxing always fails. Fall back to unsandboxed builds.