Push build result to attic cache directly from runner, then VPS substitutes it via nix-store --realise. ssh copy retained only as fallback.
Repo is now self-contained: flake.nix (tools-gateway/tools-workers/tools-frontend) + deploy.yml matrix (nix build -> nix copy -> nix-env profile -> systemctl restart). No longer dispatches submodule-updated to asepharyana-hub.