deploy guard: expose binary

modules/server-deploy-guard.nix

@@ -159,6 +159,13 @@ in
   config = lib.mkIf cfg.enable {
     environment.systemPackages = [ aggregator ];
 
+    # Expose the aggregator as a named system build so preflight drivers
+    # (deploy.sh, CI) can build just this derivation and invoke it by its
+    # /nix/store path — avoiding the bootstrap gap where
+    # /run/current-system/sw/bin/deploy-guard-check may not yet exist on the
+    # target (first deploy of the feature, post-rollback, etc).
+    system.build.deployGuardCheck = aggregator;
+
     assertions = [
       {
         assertion = cfg.checks != { };