fix(ci): docker job 从 ubuntu-latest 容器移到 nas host(修 DinD 全红)

根因:runs-on: ubuntu-latest 的 job 在 catthehacker 容器里跑,容器内嵌套
`docker run` = DinD,$PWD 在宿主不存在 → 挂载失败 → 所有套 docker 的 job 全红
(含 pre-existing 的 Codegen/Go/Flutter/Golden;纯 bash 的 redline/cleartext/
portable 不套 docker 故绿)。此前 server/site 部署 job 已因同因去 docker 直跑,
但 ci.yml 未跟进。

修:9 个套 docker 的 job(lint/openapi/flutter/codegen-drift/ds-flow/go-server/
e2e/go-integration/golden)runs-on 改 nas(host 模式=mac-pangolin-2 宿主直接跑,
docker run 是宿主真 docker 非嵌套,可正常拉跑镜像;本机已验证这些命令全绿)。
golden 保留 Linux flutter 容器 → 与入库基线渲染一致。3 个纯 bash 扫描留
ubuntu-latest(并行、已绿)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -16,12 +16,19 @@ on:
     branches: [main]
   workflow_dispatch:
 
+# runner 分配:
+#   · runs-on: ubuntu-latest —— 在 catthehacker 容器里跑,仅用于纯 bash 扫描
+#     (redline/cleartext/portable-sql);容器内**不能**嵌套 `docker run`(DinD 挂载
+#     失败,$PWD 在宿主不存在),故套 docker 的 job 不能用它。
+#   · runs-on: nas —— host 模式(mac-pangolin-2 直接在宿主跑),`docker run` 是宿主
+#     真 docker(非嵌套),可正常拉/跑 node/golang/flutter/python/shellcheck 镜像。
+#     golden 保留 ghcr.io/cirruslabs/flutter Linux 容器 → 与入库基线渲染一致。
 jobs:
 
   # ── Job 1: Lint (shellcheck) ─────────────────────────────────────────────
   lint:
     name: Lint — shellcheck
-    runs-on: ubuntu-latest
+    runs-on: nas
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -74,7 +81,7 @@ jobs:
   # ── Job 2: OpenAPI Sync Check ────────────────────────────────────────────
   openapi-check:
     name: OpenAPI Sync Check
-    runs-on: ubuntu-latest
+    runs-on: nas
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -113,7 +120,7 @@ jobs:
   # ── Job 4: Flutter 客户端(分析 + 单测/组件测试)────────────────────────
   flutter-client:
     name: Flutter — analyze + test
-    runs-on: ubuntu-latest
+    runs-on: nas
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -149,7 +156,7 @@ jobs:
   # (改了 design/colors_and_type.css 没重生成,或手改了生成物)。
   codegen-drift:
     name: Codegen Drift — token 生成物未漂移
-    runs-on: ubuntu-latest
+    runs-on: nas
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -163,7 +170,7 @@ jobs:
 
   ds-flow:
     name: DS-flow — 原型/跨端同源/代码色单源闸
-    runs-on: ubuntu-latest
+    runs-on: nas
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -182,7 +189,7 @@ jobs:
   # -tags integration(需 docker 起 mysql/redis),见 go-integration job。
   go-server:
     name: Go — build + test
-    runs-on: ubuntu-latest
+    runs-on: nas
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -208,7 +215,7 @@ jobs:
   # 详见 scripts/e2e-smoke.sh + server/test/e2e/。
   e2e-smoke:
     name: E2E Smoke — L4 进程级端到端
-    runs-on: ubuntu-latest
+    runs-on: nas
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -232,7 +239,7 @@ jobs:
   #   · -p 1 串行:一次只起一个 mysql 容器,避免并发把 Docker Desktop 压垮/端口资源争用。
   go-integration:
     name: Go — integration (mysql/redis testcontainers)
-    runs-on: ubuntu-latest
+    runs-on: nas
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -247,7 +254,7 @@ jobs:
   # tablet/desktop-stats golden 与 stats-overhaul 工作区耦合,待其合并后并入本 job。
   golden:
     name: Golden — 视觉回归 (全量:components/auth/desktop/tablet)
-    runs-on: ubuntu-latest
+    runs-on: nas
     steps:
       - name: Checkout
         uses: actions/checkout@v4