tools/bump: judge the lock bump against the real checks

flake-checks moved its nix formatter from nixpkgs-fmt to nixfmt, so every
.nix file failed the formatting check. gateFlake only ran `nix eval`, so
that reached the final gate, which drops the newest commit first and had
to pop all eleven areas above it to get there. Three hours, nothing
shipped.

tools/bump/area.go

@@ -65,15 +65,17 @@ func allAreas() []area {
 	areas = append(areas, toolAreas()...)
 	areas = append(areas,
 		area{
-			Name:    "gomod",
-			Needs:   []string{"flake"},
+			Name: "gomod",
+			// No Needs on flake. Position in this slice is what puts it after
+			// the lock bump; making it a dependency meant an unadoptable
+			// nixpkgs also threw away the day's dependency upgrades, which
+			// have nothing to do with it.
 			Apply:   applyGoMod,
 			Gate:    gateGoMod,
 			Message: func(c change) string { return "go.mod: " + c.Summary },
 		},
 		area{
 			Name:    "docker-go",
-			Needs:   []string{"flake"},
 			Apply:   applyDockerGo,
 			Gate:    gateDockerGo,
 			Message: func(c change) string { return "Dockerfile: bump " + c.Summary },
@@ -94,7 +96,6 @@ func allAreas() []area {
 	// pre-commit hooks judge the finished tree rather than an intermediate one.
 	return append(areas, area{
 		Name:    "fmt",
-		Needs:   []string{"flake"},
 		Apply:   applyFormat,
 		Message: func(change) string { return "all: satisfy the formatters and pre-commit hooks" },
 	})

tools/bump/flake.go

@@ -113,10 +113,25 @@ func shortList(names []string) string {
 
 // gateFlake proves the flake still evaluates before anything expensive runs.
 func gateFlake(ctx context.Context, r *repo) error {
-	_, err := r.run(ctx, "nix", "eval", "--raw",
-		fmt.Sprintf(".#packages.%s.headscale.name", r.System))
+	if _, err := r.run(ctx, "nix", "eval", "--raw", //nolint:noinlineerr
+		fmt.Sprintf(".#packages.%s.headscale.name", r.System)); err != nil {
+		return err
+	}
 
-	return err
+	// The lock bump is judged against the same checks the final gate runs,
+	// because it is the one change that can invalidate all of them at once: a
+	// new nixpkgs moves every formatter and linter the checks are built from.
+	// It is also the first commit, which is the worst case for a rewind that
+	// drops the newest commit first. Paying for one round of checks here is
+	// what stops the final gate paying for one round per area stacked above it.
+	for _, check := range flakeChecks {
+		err := nixCheck(ctx, r, check)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
 }
 
 // goVersion is the Go the devShell provides, without the "go" prefix.