ci: expose angieVersion as plain string attr; fix push step

Use `nix eval --raw .#angieVersion` instead of trying to read a
writeText derivation that was never built. Also call streamLayeredImage
output via process-substitution properly.

.woodpecker.yaml

@@ -43,12 +43,12 @@ steps:
         EOF
       - if [ -n "$GITEA_CLONE_TOKEN" ]; then echo "machine git.oleks.space login oleks password $GITEA_CLONE_TOKEN" >~/.netrc && chmod 600 ~/.netrc; fi
 
-      # Build the image (a script that streams the OCI tar to stdout).
-      - nix build .#default --print-out-paths --no-link
-      - VERSION="$(nix eval --raw .#version | xargs cat)"
-      - echo "Built angie $VERSION"
+      # Resolve the upstream Angie version and build the image stream script.
+      - VERSION="$(nix eval --raw .#angieVersion)"
+      - echo "Building angie $VERSION"
+      - STREAM="$(nix build .#default --print-out-paths --no-link)"
 
-      # Push to Gitea OCI registry under both the version tag and `latest-arm64`.
+      # Auth + push to Gitea OCI registry under both <ver>-arm64 and latest-arm64.
       - mkdir -p ~/.config/containers
       - |
         printf '{"auths":{"git.oleks.space":{"auth":"%s"}}}\n' \
@@ -57,7 +57,7 @@ steps:
       - |
         nix run nixpkgs#skopeo -- copy --insecure-policy \
           --authfile ~/.config/containers/auth.json \
-          docker-archive:<($(nix build .#default --print-out-paths --no-link)) \
+          docker-archive:<("$STREAM") \
           docker://git.oleks.space/oleks/angie:$VERSION-arm64
       - |
         nix run nixpkgs#skopeo -- copy --insecure-policy \