The act_runner is a systemd service with no login session → XDG_RUNTIME_DIR unset → rootless buildah uses root-owned /run/containers and fails 'mkdir /run/containers: permission denied'. Set XDG_RUNTIME_DIR to a per-job mktemp dir so its runroot is writable. (check + on:/go-version fixes already landed; this unblocks the image build → registry.)