refactor: migrate CD from gha to hercules-ci effects

.github/workflows/deploy-docs.yaml → .github/deprecated/deploy-docs.yaml

@@ -92,7 +92,7 @@ jobs:
         env:
           SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
         with:
-          installer: quick
+          installer: full
           system: x86_64-linux
 
       - name: Setup tmate debug session
@@ -103,17 +103,29 @@ jobs:
         if: steps.cache.outputs.should-run == 'true'
         id: deployment
         env:
+          # SOPS_AGE_KEY decrypts secrets/shared.yaml at step time. The sops exec-env
+          # wrap moves to the caller (deploy.sh no longer calls sops internally).
           SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
           GITHUB_ACTIONS: "true"
           GITHUB_ACTOR: ${{ github.actor }}
           GITHUB_WORKFLOW: ${{ github.workflow }}
           DEPLOY_ENVIRONMENT: ${{ inputs.environment }}
           DEPLOY_BRANCH: ${{ inputs.branch }}
         run: |
+          # Use `nix develop -c` so sops is guaranteed on PATH
+          # (setup-nix composite action provides nix, but not sops on
+          # the bare runner); sops exec-env populates CLOUDFLARE_API_TOKEN
+          # and CLOUDFLARE_ACCOUNT_ID before the nix-run invocation.
+          # `sops exec-env` takes (file, single-shell-command-string) so
+          # the nested nix-run invocation is a single quoted string.
           if [ "$DEPLOY_ENVIRONMENT" = "preview" ]; then
-            nix run .#deploy-docs -- preview "$DEPLOY_BRANCH"
+            nix develop --accept-flake-config -c \
+              sops exec-env secrets/shared.yaml \
+              "nix run --accept-flake-config .#deploy-docs -- preview \"$DEPLOY_BRANCH\""
           else
-            nix run .#deploy-docs -- production
+            nix develop --accept-flake-config -c \
+              sops exec-env secrets/shared.yaml \
+              "nix run --accept-flake-config .#deploy-docs -- production"
           fi
 
       - name: Create job result marker

.github/workflows/package-release.yaml → .github/deprecated/package-release.yaml

@@ -110,7 +110,7 @@ jobs:
         uses: ./.github/actions/cached-ci-job
         with:
           check-name: ${{ inputs.package-name }}-release
-          hash-sources: 'packages/${{ inputs.package-name }}/**/* packages/docs/package.json bun.lock flake.lock flake.nix modules/apps/docs/release.nix modules/apps/docs/release.sh justfile .github/actions/setup-nix/action.yml .github/workflows/package-release.yaml'
+          hash-sources: 'packages/${{ inputs.package-name }}/**/* packages/docs/package.json bun.lock flake.lock flake.nix modules/apps/release/release.nix modules/apps/release/release.sh justfile .github/actions/setup-nix/action.yml .github/workflows/package-release.yaml'
           force-run: ${{ inputs.force-run }}
 
       - name: Setup Nix