feat: add a Linux CI job alongside macOS, in one shared workflow

Renamed macos.yml to ci.yml with two jobs (macos, linux) under one
push/PR/dispatch trigger, so both run from the same commit instead of
needing separate files. Cache keys are now OS-prefixed (cargo-macos-/
cargo-linux-): target/ artifacts are platform-specific and would
otherwise collide under a shared key.

.forgejo/workflows/macos.yml

@@ -1,41 +0,0 @@
-name: macOS
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-  workflow_dispatch:
-
-jobs:
-  check:
-    runs-on: macos-arm64
-    steps:
-      - uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          path: carrier
-      # Cargo.toml depends on fumi-core via a relative sibling path
-      # (../fumi/core), matching how it's checked out locally. Fetched as
-      # its own sibling checkout here so that path resolves the same way.
-      - uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          repository: randogoth/fumi
-          ref: main
-          path: fumi
-      - uses: https://code.forgejo.org/actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            carrier/target
-            fumi/target
-          key: cargo-${{ hashFiles('carrier/Cargo.lock') }}
-          restore-keys: cargo-
-      # Forgejo auto-injects GITHUB_TOKEN (GH Actions compatibility), scoped
-      # to this Forgejo instance. Nix auto-detects that env var and assumes
-      # it's a github.com credential, so it sends it to api.github.com when
-      # fetching nixpkgs tarballs for devbox - which rejects it with 401.
-      # Clearing it here falls back to unauthenticated (fine for public
-      # nixpkgs fetches, same as this succeeds locally with no token set).
-      - run: devbox run check
-        working-directory: carrier
-        env:
-          GITHUB_TOKEN: ""