ci: add V1 build tier to automated lock bumps

.gitea/workflows/bump.yml

@@ -7,13 +7,14 @@
 # Fast lane: workflow_dispatch. For a security fix upstream, run this
 # workflow manually from the Actions tab instead of waiting for Monday.
 #
-# Gate scope: `nix flake check --no-build` — the same eval tier as
-# check.yml (this runner has no KVM; see item 20 for the VM-suite
+# Gate scope: `nix flake check --no-build` (eval tier) followed by a V1 build
+# (home-manager activation package + nixos toplevel) to catch compilation errors.
+# (this runner has no KVM; see item 20 for the VM-suite
 # upgrade path). The py_compile/bash -n steps are skipped on purpose:
 # they don't read flake.lock, so a lock bump cannot break them. The
 # bump commit's own push then triggers check.yml as a second net.
-# A green bump therefore guards evaluation, not VM behaviour — the
-# checks.* suite still runs locally / at promotion time.
+# A green bump therefore guards evaluation and compilation, not VM behaviour —
+# the checks.* suite still runs locally / at promotion time.
 #
 # Failure mode: a red gate fails this run visibly and pushes nothing;
 # next schedule retries. A push race (someone landed on main mid-run)
@@ -71,6 +72,12 @@ jobs:
         if: steps.update.outputs.changed == '1'
         run: nix flake check --no-build
 
+      - name: Gate — V1 build (toplevel + home-manager)
+        if: steps.update.outputs.changed == '1'
+        run: |
+          nix build .#homeConfigurations.nomarchy.activationPackage --no-link
+          nix build .#nixosConfigurations.nomarchy.config.system.build.toplevel --no-link
+
       - name: Commit + push on green
         if: steps.update.outputs.changed == '1'
         # The checkout step persists the Actions token, so this push