fix(ci): memory-bounded eval — one output per nix process

check.yml has been permanently red since the runner container was
capped at 2 GB (uncapped, it OOM'd the whole 4 GB VPS). Root cause,
measured with GNU time (eval-cache off): `nix flake check --no-build`
walks every output in ONE evaluator process and peaks at ~6.0 GB RSS
on this repo — the checks.* suite alone is ~15 runNixOSTests, each a
full NixOS eval, all accumulating in one heap.

New tools/ci-eval.sh: identical coverage (all checks.* drvPaths, both
nixosConfigurations toplevels, the HM activationPackage — enumerated
dynamically, no drift), one fresh nix process per output so the heap is
freed between outputs. Cold per-output peaks: worst check 0.99 GB
(hardware-toggles), nomarchy toplevel 0.78 GB, HM 0.60 GB; the one
outlier is nomarchy-live at 2.69 GB (live-ISO eval), which fits the
2 GB cap only via the container's swap allowance (docker's default
--memory-swap is 2x memory). check.yml and bump.yml both call the
script now; bump.yml also gains max-jobs=1/cores=2 (it had no limits,
so its V1 build gate could spawn parallel builders in the capped
container). ROADMAP's stale "no CI today" corrected: bump.yml landed
8fded63 on schedule 2026-07-06.

Verified: V1+ — ci-eval.sh green locally end-to-end (3m22s, tree peak
2.75 GB = nomarchy-live's process); per-output peaks measured
individually. The decisive proof is the next Actions run on the VPS
itself — watch the nomarchy-live step; if it OOMs there, the runner
needs swap allowed: --memory=2g --memory-swap=6g.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -1000,10 +1000,18 @@ Design/decision records and a running log of shipped work (items marked
   shrinks the security-patch latency the single-input model otherwise imposes
   (users are gated on the maintainer for nixpkgs CVEs), since a fix is usually
   already eval/build/VM-tested and one hardware promotion away from `v1` —
-  worth fast-laning lock-only/security bumps ahead of feature batches. The repo
-  has **no CI today** (manual `nix flake update` only). Explicitly *not* a
-  binary cache: compile-from-source is a deliberate values call (Gentoo-style),
-  so this automates the *config/lock* channel, not artifact distribution.
+  worth fast-laning lock-only/security bumps ahead of feature batches.
+  **Shipped since:** `.gitea/workflows/check.yml` (eval tier on every main
+  push) and `bump.yml` (Monday 05:17 UTC scheduled lock bump, eval + V1
+  build gate, auto-lands on green — first landing 8fded63, 2026-07-06).
+  2026-07-12: both gates moved from one big `nix flake check --no-build`
+  (~6.0 GB peak RSS — OOM'd the 4 GB VPS, then could never fit the
+  runner's 2 GB container cap) to `tools/ci-eval.sh`, one output per nix
+  process (worst single output: nomarchy-live at 2.69 GB — needs the
+  container's default swap allowance; everything else ≤ 1 GB). Explicitly
+  *not* a binary cache: compile-from-source is a deliberate values call
+  (Gentoo-style), so this automates the *config/lock* channel, not
+  artifact distribution.
 - ✓ **Opt-in auto-commit of state mutations (in-flake state, Phase 4):**
   `settings.autoCommit` (menu: **System › Auto-commit**, self-gated on the
   flake being a git repo) makes every `apply`/`set` also `git commit`