feat(hetzner): add restricted release hosting and update CI

.gitea/workflows/ci.yml

@@ -13,10 +13,13 @@
 #     PATH before invoking `nix`. This uses the host's actual Lix rather than installing a
 #     second Nix client that would mismatch the running Lix daemon.
 #   * Gitea context vars (gitea.workflow / gitea.head_ref / gitea.sha) for concurrency.
-#   * matrix over x86_64-linux + aarch64-linux for flake-check (--no-build, eval-only).
-#     Pre-commit checks run on x86_64-linux only: building aarch64 derivations needs
-#     QEMU binfmt (registered via boot.binfmt.emulatedSystems) + nix extra-platforms,
-#     which require a nixos-rebuild switch that hasn't been applied yet.
+#   * matrix over x86_64-linux + aarch64-linux.
+#     All jobs use --no-build (eval-only) because the runner has 2 cores / 4GB RAM:
+#     building nix derivations would exhaust memory and crash the server.
+#     Pre-commit hooks run locally via git-hooks-nix on the developer's machine.
+#   * aarch64 builds need QEMU binfmt (boot.binfmt.emulatedSystems) + nix extra-platforms,
+#     which require a nixos-rebuild switch not yet applied. Flake-check for aarch64
+#     runs eval-only (no build) and passes.
 
 name: CI
 
@@ -61,24 +64,3 @@ jobs:
         run: |
           export PATH=/run/current-system/sw/bin:$PATH
           nix flake check --no-build --system ${{ matrix.system }}
-
-  pre-commit:
-    name: Pre-commit checks (${{ matrix.system }})
-    runs-on: native
-    strategy:
-      fail-fast: false
-      matrix:
-        # aarch64-linux omitted: building aarch64 derivations needs QEMU binfmt +
-        # extra-platforms; system hasn't been rebuilt to apply them yet.
-        system:
-          - x86_64-linux
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - name: Pre-commit checks (${{ matrix.system }})
-        run: |
-          export PATH=/run/current-system/sw/bin:$PATH
-          nix build .#checks.${{ matrix.system }}.pre-commit