Tag checkout results in detached HEAD, so git push fails.
Fetch and checkout main branch before committing flake.nix update.