ci: run nothing but a main-only bin-cache push on the public forge

Guards internal-only jobs (ci.yml, coverage.yml, flake-update.yml) with
`vars.PUBLIC_CACHE != 'true'` and adds public-cache.yml, guarded to the
inverse, to build the deployed closures and push them to the public
attic cache on a push to main.

`PUBLIC_CACHE` is a repo Actions variable, opt-in only on the public
copy: unset here, it leaves internal CI's `!=` guards true so internal
jobs always run. Job-level `if:` cannot see the `github`/`forgejo`
context at all on this runner (confirmed empirically — a
`github.server_url` comparison always evaluates false at job level,
though the identical comparison resolves correctly inside a step),
so `vars.*`, which is available at job level, is the only usable
opt-in signal here.

.forgejo/workflows/flake-update.yml

@@ -22,6 +22,7 @@ on:
 jobs:
   update:
     name: nix flake update
+    if: vars.PUBLIC_FORGE != 'true'
     runs-on: [hive-ci]
     timeout-minutes: 30
     steps: