ci(smoke): use buildah run instead of sudo k3s ctr for smoke test

Same fix as cobalt-dingo — removes the sudo/host-containerd dependency so
this still works once the act_runner is containerized (infra#132).

Refs infra#132.

.gitea/workflows/ci.yml

@@ -78,14 +78,17 @@ jobs:
               ${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.version-tag }} || true
           echo "Image pushed to ${REF}"
 
+      # Run the just-built local image briefly via buildah, not k3s ctr —
+      # avoids sudo/host-containerd access so this still works once the
+      # runner itself is containerized (infra#132). Tests the local
+      # buildah-store image directly, no registry round-trip needed.
       - name: Smoke test
         run: |
           REGISTRY="localhost:5000"
           REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
-          CNAME="smoke-${{ steps.meta.outputs.sha-tag }}"
-          sudo k3s ctr images pull --plain-http ${REF}
-          OUTPUT=$(timeout 5 sudo k3s ctr run --rm ${REF} ${CNAME} /tapir 2>&1 || true)
-          sudo k3s ctr containers delete ${CNAME} 2>/dev/null || true
+          CONTAINER=$(buildah from ${REF})
+          OUTPUT=$(timeout 5 buildah run "$CONTAINER" -- /tapir 2>&1 || true)
+          buildah rm "$CONTAINER" >/dev/null
           echo "$OUTPUT" | grep -q "tapir" \
             && echo "Smoke test passed" \
             || echo "Smoke test inconclusive: $OUTPUT"