ci: re-enable cache push step (named-volume bind for relative path)

.gitea/workflows/validate-pr.yml

@@ -68,9 +68,7 @@ jobs:
             done
           done
 
-      # 4. Build smoke — every changed package must build. Cache push
-      #    is intentionally absent for now (no shared binary cache);
-      #    add a step here once cache infra is decided.
+      # 4. Build smoke — every changed package must build.
       - name: build smoke
         if: steps.changed.outputs.packages != ''
         run: |
@@ -79,6 +77,18 @@ jobs:
               .#${pkg} --no-link --print-out-paths
           done
 
+      # 4b. Push the validated outputs to the binary cache. The runner's
+      #     config.yaml bind-mounts /srv/cargoxx-cache and the signing
+      #     key into every job container.
+      - name: push to binary cache
+        if: steps.changed.outputs.packages != ''
+        run: |
+          for pkg in ${{ steps.changed.outputs.packages }}; do
+            nix copy --extra-experimental-features 'nix-command flakes' \
+              --to "file:///srv/cargoxx-cache/store?secret-key=/srv/cargoxx-cache/keys/cache.sec" \
+              .#${pkg}
+          done
+
       # 5. Maintainer check — PR must come from someone listed in
       #    recipes/<pkg>/maintainers.txt (auto-pass for new packages,
       #    since the PR introduces the file in the same commit).