ci: run flake-closure-diff on dev-kit's own flake changes

.github/workflows/flake-closure-diff-self.yml

@@ -0,0 +1,22 @@
+name: flake-closure-diff
+
+# dev-kit calling its own reusable workflow, the way a consumer calls it. The
+# reference is local, as in renovate-auto-approve-self: it always exercises the
+# version in the branch and needs no self-referencing SHA.
+#
+# The workflow itself is in the paths so a change to it is exercised before it
+# reaches consumers, not only on the next lock bump.
+on:
+  pull_request:
+    paths:
+      - flake.lock
+      - flake.nix
+      - .github/workflows/flake-closure-diff.yml
+      - .github/workflows/flake-closure-diff-self.yml
+
+permissions:
+  contents: read
+
+jobs:
+  closure-diff:
+    uses: ./.github/workflows/flake-closure-diff.yml

.github/workflows/flake-closure-diff.yml

@@ -21,10 +21,6 @@ on:
           both sides are addressed as <path>#<attribute>.
         type: string
         default: devShells.x86_64-linux.default
-      runs-on:
-        description: Runner for the job.
-        type: string
-        default: ubuntu-24.04
     secrets:
       cachix-auth-token:
         required: false
@@ -37,7 +33,7 @@ permissions:
 jobs:
   closure-diff:
     name: Diff flake closures
-    runs-on: ${{ inputs.runs-on }}
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -114,7 +110,7 @@ jobs:
             echo "## Dev shell closure diff"
             echo
             if [ -z "$diff" ]; then
-              echo "No package-level change: the lock moved but the shell is identical."
+              echo "No package-level change in the dev shell."
             else
               echo '```'
               echo "$diff"