fix(ci): no expression syntax in a run: block's comments

act interpolates a `run:` block INCLUDING its shell comments, so prose
containing Actions expression syntax is evaluated as an expression. A
comment I added yesterday explaining why a fallback was computed in shell
contained that syntax as an example; act tried to evaluate it, failed
with "Unavailable context: a", and the step then wrote NO outputs at all.

In gitea-mcp that emptied `needs.build.outputs.image-tag`, so its deploy
job committed `image: localhost:5000/gitea-mcp:` to the infra repo --
which is not valid YAML, so Flux's apps Kustomization went Ready:False
and NOTHING in k3s/apps reconciled estate-wide until infra 51ceb7c.

The build still went green throughout, because the shared build-image.sh
falls back to `git rev-parse --short HEAD` when SHA_TAG is empty. A
robust default hid a broken input -- worth remembering as a pattern.

Same comment text removed here; the explanation stays, the syntax does not.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011PL5XcG68SvQqz3vGVbWbf

.gitea/workflows/cd.yml

@@ -60,10 +60,17 @@ jobs:
             echo "version-tag=${REF#refs/tags/}" >> "$GITHUB_OUTPUT"
             echo "version=${REF#refs/tags/}" >> "$GITHUB_OUTPUT"
           else
-            # The ldflags version stamp: git tag on a v* build, else short sha.
-            # Computed here in shell, not as a `${{ a || b }}` expression, so it
-            # cannot depend on how the runner treats an empty step output -- a
-            # wrong VERSION would be baked into the binary silently.
+            # The ldflags version stamp: git tag on a v* build, else short
+            # sha. Computed in shell rather than as a fallback expression in
+            # YAML, so it cannot depend on how the runner treats an empty step
+            # output -- a wrong VERSION would be baked into the binary silently.
+            #
+            # NOTE: no expression syntax in this comment, deliberately. act
+            # interpolates a run: block INCLUDING its comments, so prose
+            # containing that syntax is evaluated as an expression -- it failed
+            # with "Unavailable context: a", the step wrote no outputs, and the
+            # deploy job committed an empty image tag that broke Flux
+            # estate-wide (infra 51ceb7c).
             echo "version=${SHA}" >> "$GITHUB_OUTPUT"
           fi