CI: nix flake check runs all tests; Gitea workflow

- flake: checks.tests = the sausage package with doCheck (tests of sausage,
  sausage-actor, agent; fixtures build offline from vendored crates).
- .gitea/workflows/ci.yml: `nix flake check -L` on runner label `nixos`.

Not compiled: written by the Sausage agent.

.gitea/workflows/ci.yml

@@ -0,0 +1,11 @@
+# Runs on the Nix runner on nexus (label `nixos`, host executor).
+name: ci
+on: [push, pull_request]
+
+jobs:
+  check:
+    runs-on: nixos
+    steps:
+      - uses: actions/checkout@v4
+      - name: nix flake check
+        run: nix flake check -L --show-trace

AGENTS.md

@@ -35,6 +35,7 @@ Keep it that way.
 ## Checks
 
 ```sh
+nix flake check -L      # all tests below; CI runs this on every push
 nix develop -c cargo test -p sausage -p sausage-actor -p agent
 nix develop -c cargo build --release -p agent --target wasm32-wasip2
 nix develop -c cargo clippy --workspace

flake.nix

@@ -58,6 +58,19 @@
       {
         packages.default = sausage;
 
+        # `nix flake check` runs every test of the host, the SDK, and the
+        # agent. The tests build WASM actors with cargo, offline, from the
+        # vendored crates of Cargo.lock.
+        checks.tests = sausage.overrideAttrs (old: {
+          pname = "sausage-tests";
+          doCheck = true;
+          cargoTestFlags = [ "-p" "sausage" "-p" "sausage-actor" "-p" "agent" ];
+          preCheck = ''
+            # Its own lock file pins crates that the vendored set may lack.
+            rm -f cli/tests/actors/toolbox/Cargo.lock
+          '';
+        });
+
         apps.default = { type = "app"; program = "${sausage}/bin/sausage"; };
         apps.loop = { type = "app"; program = "${loop "sausage-loop" publicUrl}/bin/sausage-loop"; };
         apps.loop-internal = { type = "app"; program = "${loop "sausage-loop-internal" internalUrl}/bin/sausage-loop-internal"; };