fixup: stateVersion 26.05, drop ubuntu labels, simplify CI workflow

- stateVersion: 25.11 → 26.05 (match hive-gateway + hive-matrix)
- default labels: drop ubuntu-latest/ubuntu-22.04 aliases — misleading
  since this isn't Ubuntu; hive-ci:host is the correct label
- ci.yml: collapse to single `nix flake check` job — flake checks.* already
  covers formatting (treefmt+rustfmt), cargo test, and clippy

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

nix/modules/hive-ci.nix

@@ -115,11 +115,7 @@ in
 
     labels = lib.mkOption {
       type = lib.types.listOf lib.types.str;
-      default = [
-        "hive-ci:host"
-        "ubuntu-latest:host"
-        "ubuntu-22.04:host"
-      ];
+      default = [ "hive-ci:host" ];
       example = [
         "hive-ci:host"
         "nix:host"
@@ -128,10 +124,6 @@ in
         Runner labels in `<name>:<scheme>` format. The `host` scheme runs
         commands directly in the container (no docker/podman). Workflow
         files target this runner with `runs-on: [hive-ci]`.
-
-        The `ubuntu-latest` and `ubuntu-22.04` aliases let workflow files
-        that hardcode GitHub-style runner names work unchanged, as long as
-        those jobs only need git + nix + cargo and not Ubuntu APT packages.
       '';
     };
 
@@ -173,7 +165,7 @@ in
       config =
         { pkgs, lib, ... }:
         {
-          system.stateVersion = "25.11";
+          system.stateVersion = "26.05";
 
           # nspawn containers can't create user-namespaces, so nix
           # sandboxing always fails. Fall back to unsandboxed builds.