chore(justfile): mirror new commits to gitea instead of re-squashing

push-all now cherry-picks new main commits onto the gitea-sync branch on top
of the clean baseline, so history is visible on gitea from this point forward
while the pre-existing history stays hidden.

justfile

@@ -36,18 +36,31 @@ check:
 
 # Push to BOTH remotes:
 #   origin (full history, ssh://git@homeserver:2222)
-#   gitea  (public snapshot mirror: the current tree as ONE root commit, so no
-#           old history / historical secrets are ever visible on gitea.edley.me)
+#   gitea  (public mirror: a clean squashed BASELINE commit, then real commits
+#           cherry-picked on top so history is visible from now on)
+# How the mirror works:
+#   - `gitea-sync` branch holds what Gitea should show (starts at the baseline).
+#   - `sync-last` tracks the last `main` commit already mirrored.
+#   - Each run cherry-picks the new main commits onto `gitea-sync` and pushes,
+#     so old history (and historical secrets) never appear on gitea.edley.me.
 # NOTE: gitea push authenticates via ~/.git-credentials (the gitea-mcp-token).
 # Run from a clean tree; commit first.
 push-all:
     #!/usr/bin/env bash
     set -euo pipefail
     git push origin main
-    MSG="Nix-Vibe public snapshot (squashed history)"
-    ROOT_SHA=$(git commit-tree HEAD^{tree} -m "$MSG")
-    git push --force gitea "$ROOT_SHA:refs/heads/main"
-    echo "pushed main -> origin (full) and snapshot -> gitea"
+    NEW_COMMITS=$(git rev-list --reverse sync-last..main)
+    if [ -z "$NEW_COMMITS" ]; then
+      echo "no new commits since last mirror; gitea is current"
+      exit 0
+    fi
+    git checkout -q gitea-sync
+    echo "cherry-picking onto gitea-sync:"
+    git cherry-pick $NEW_COMMITS
+    git push gitea gitea-sync:main
+    git checkout -q main
+    git update-ref refs/heads/sync-last main
+    echo "pushed main -> origin (full) and $(echo "$NEW_COMMITS" | wc -l) new commit(s) -> gitea"
 
 # ===== deployment helpers (no quickshell restart) =====