Kieran's opinionated (and probably slightly dumb) nix config

fix: use tag:ci in reusable deploy workflow

Matches existing Tailscale ACL configuration used by all service repos.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

dunkirk.sh e0a5c67e 023c6cd5

verified
+1 -1
+1 -1
.github/workflows/deploy-service.yml
··· 47 47 with: 48 48 oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }} 49 49 oauth-secret: ${{ secrets.TS_OAUTH_SECRET }} 50 - tags: tag:deploy 50 + tags: tag:ci 51 51 use-cache: "true" 52 52 53 53 - name: Configure SSH