ci: run nothing but a main-only bin-cache push on the public forge

Guards internal-only jobs (ci.yml, coverage.yml, flake-update.yml) with
`vars.PUBLIC_CACHE != 'true'` and adds public-cache.yml, guarded to the
inverse, to build the deployed closures and push them to the public
attic cache on a push to main.

`PUBLIC_CACHE` is a repo Actions variable, opt-in only on the public
copy: unset here, it leaves internal CI's `!=` guards true so internal
jobs always run. Job-level `if:` cannot see the `github`/`forgejo`
context at all on this runner (confirmed empirically — a
`github.server_url` comparison always evaluates false at job level,
though the identical comparison resolves correctly inside a step),
so `vars.*`, which is available at job level, is the only usable
opt-in signal here.

.forgejo/workflows/coverage.yml

@@ -17,6 +17,7 @@ on:
 jobs:
   coverage:
     name: cargo llvm-cov
+    if: vars.PUBLIC_FORGE != 'true'
     runs-on: [hive-ci]
     # Above the 30 min `nix flake check` allows, because instrumented
     # builds are slower than the ordinary ones and this starts from a