GitHub path filters do not match submodule gitlink changes, so the `paths: apps/**` filter meant a submodule pointer update never triggered the deploy. Drop the filter so any push to main deploys (matches the documented "Push to main -> nix build -> systemctl restart"). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>