The act_runner is a systemd service with no login session → XDG_RUNTIME_DIR
unset → rootless buildah uses root-owned /run/containers and fails 'mkdir
/run/containers: permission denied'. Set XDG_RUNTIME_DIR to a per-job mktemp
dir so its runroot is writable. (check + on:/go-version fixes already landed;
this unblocks the image build → registry.)
Bare 'on:' is a YAML boolean (Norway problem) — parsed as the key True, not
the string 'on'. Gitea's workflow loader then materialised 0 jobs and every run
failed instantly. Quoting "on": fixes dispatch.
check -> build -> mirror, self-hosted runner, buildah to localhost:5000, k3s
smoke test. Follows the gitea-ci skill template and its act_runner gotchas
(secrets inlined in run:, no heredocs). check will be RED until the engine is
implemented (acceptance suite). Deploy job omitted until k3s manifests exist in
infra. GH_DEPLOY_KEY secret must be set before mirror succeeds.