fix(ci): give rootless buildah a writable XDG_RUNTIME_DIR in build job

The act_runner is a systemd service with no login session → XDG_RUNTIME_DIR
unset → rootless buildah uses root-owned /run/containers and fails 'mkdir
/run/containers: permission denied'. Set XDG_RUNTIME_DIR to a per-job mktemp
dir so its runroot is writable. (check + on:/go-version fixes already landed;
this unblocks the image build → registry.)

.gitea/workflows/ci.yml

@@ -63,6 +63,11 @@ jobs:
 
       - name: Build and push to local registry
         run: |
+          # The act_runner is a systemd service with no login session, so
+          # XDG_RUNTIME_DIR is unset and rootless buildah falls back to the
+          # root-owned /run/containers ("mkdir /run/containers: permission
+          # denied"). Point its runroot at a writable per-job temp dir instead.
+          export XDG_RUNTIME_DIR="$(mktemp -d /tmp/buildah-run.XXXXXX)"
           REGISTRY="localhost:5000"
           REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
           buildah build \