fix(workflow): add git stash and pre-push validation

.gitea/workflows/nix-update.yml

@@ -334,10 +334,29 @@ jobs:
           echo "Current commit: $(git rev-parse HEAD)"
           echo "Pending commits: $(git rev-list --count origin/master..HEAD)"
 
+          # Clean working directory before rebase
+          if [ "$(git status --porcelain)" != "" ]; then
+            echo "::warning::Working directory has uncommitted changes, stashing..."
+            git stash push -u -m "workflow-temp-changes" || {
+              echo "::error::Failed to stash changes, aborting"
+              exit 1
+            }
+            echo "::notice::Changes stashed successfully"
+          fi
+
           echo ""
           echo "Pulling latest changes (rebase)..."
           if git pull --rebase origin master; then
             echo "✅ Rebase successful"
+
+            # Unstash changes after successful rebase
+            if git stash list | grep -q "workflow-temp-changes"; then
+              echo "::notice::Restoring stashed changes..."
+              git stash pop || {
+                echo "::warning::Failed to restore stash, continuing with clean state"
+                git stash drop stash@{0} || true
+              }
+            fi
           else
             echo "⚠️ Rebase failed, attempting force push..."
             git reset --hard origin/master
@@ -346,6 +365,12 @@ jobs:
             exit 0
           fi
 
+          # Pre-push validation: ensure clean state
+          if [ "$(git status --porcelain)" != "" ]; then
+            echo "::error::Working directory not clean after operations, aborting push"
+            exit 1
+          fi
+
           echo ""
           echo "Pushing changes to master..."
           git push origin master