deploy guard: expose binary

.gitea/workflows/deploy.yml

@@ -65,10 +65,15 @@ jobs:
 
       - name: Deploy guard preflight
         run: |
+          # The gitea runner runs on muffin itself, so the /nix/store path
+          # produced by "Build muffin" is already resolvable on the target.
+          # SSH to root is still needed so the check can read agenix secrets
+          # (e.g. /run/agenix/jellyfin-api-key is mode 0400 root).
+          guard=$(readlink -f result)/sw/bin/deploy-guard-check
           ssh -i /run/agenix/ci-deploy-key \
             -o StrictHostKeyChecking=yes \
             -o UserKnownHostsFile=/etc/ci-known-hosts \
-            root@server-public deploy-guard-check
+            root@server-public "$guard"
 
       - name: Deploy via deploy-rs
         run: |