ci: check out via actions/checkout (repo is SHA-1, not SHA-256)

Run 110's lint job failed at checkout ("couldn't find remote ref <sha>")
because GIT_DEFAULT_HASH: sha256 — copied from the SHA-256 homeserver repo —
made git init create a SHA-256 repo that can't resolve this repo's SHA-1
commits. This overlay is a plain SHA-1 repo, so checkout needs no hash override.

- lint job: drop the bogus GIT_DEFAULT_HASH: sha256 override.
- build job: replace the curl+tar checkout with actions/checkout into
  $GITHUB_WORKSPACE, registered with portage via repos.conf; pull dev-vcs/git
  in Configure portage (stage3 has no git, which checkout shells out to) and
  drop net-misc/curl (only the old checkout used it). QA scan / verify steps
  now reference $GITHUB_WORKSPACE.
- CLAUDE.md: correct the SHA-256 claim and rewrite the CI section for the
  two-job lint-gate + actions/checkout setup.

just lint passes; ci.yaml passes actionlint.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS

.gitea/workflows/ci.yaml

@@ -9,14 +9,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      # SHA-256 Gitea repo: actions/checkout's internal `git init` must also
-      # create a SHA-256 repo or the fetch-by-OID fails ("mismatched
-      # algorithms"). GIT_DEFAULT_HASH makes init match. (The build job below
-      # avoids checkout for the same SHA-256 reason but predates this
-      # workaround; its curl+tar still works, so it is left as-is.)
       - uses: actions/checkout@v4
-        env:
-          GIT_DEFAULT_HASH: sha256
 
       # setup-just fetches its binary from GitHub; on a Gitea runner the default
       # github-token is the *Gitea* token (GitHub rejects it 401), so pass none
@@ -59,7 +52,8 @@ jobs:
       # pkgcore (pkgcheck) only reads /etc/portage/repos.conf, and the binhost
       # needs the Gentoo release keys we don't ship — disable binpkg signature
       # verification (ephemeral CI container) so prebuilt deps like dev-lang/go
-      # can be pulled instead of compiled.
+      # can be pulled instead of compiled. dev-vcs/git is pulled here too because
+      # actions/checkout (next step) shells out to git, and stage3 has none.
       - name: Configure portage
         run: |
           mkdir -p /etc/portage/repos.conf
@@ -67,26 +61,22 @@ jobs:
             > /etc/portage/repos.conf/gentoo.conf
           sed -i '/^verify-signature/d' /etc/portage/binrepos.conf/gentoo.conf
           printf '\nverify-signature = false\n' >> /etc/portage/binrepos.conf/gentoo.conf
-          emerge -q --getbinpkg net-misc/curl dev-util/pkgcheck
+          emerge -q --getbinpkg dev-vcs/git dev-util/pkgcheck
 
-      # Place this overlay at /var/db/repos/azy5030. actions/checkout is avoided
-      # (SHA-256 Gitea repos break it); curl + tar fetches the source archive.
+      # Check out the overlay into the workspace (plain SHA-1 repo, so no
+      # GIT_DEFAULT_HASH override), then register that path with portage.
       - name: Check out overlay
-        env:
-          TOKEN: ${{ github.token }}
+        uses: actions/checkout@v4
+
+      - name: Register overlay with portage
         run: |
-          host=${GITHUB_SERVER_URL#http://}; host=${host#https://}
-          url="http://x-access-token:${TOKEN}@${host}/${GITHUB_REPOSITORY}/archive/${GITHUB_REF_NAME}.tar.gz"
-          curl -fsSL "$url" -o repo.tar.gz
-          mkdir -p /var/db/repos/azy5030
-          tar xzf repo.tar.gz -C /var/db/repos/azy5030 --strip-components=1
-          printf '[azy5030]\nlocation = /var/db/repos/azy5030\nmasters = gentoo\nauto-sync = false\n' \
+          printf '[azy5030]\nlocation = %s\nmasters = gentoo\nauto-sync = false\n' "$GITHUB_WORKSPACE" \
             > /etc/portage/repos.conf/azy5030.conf
           mkdir -p /etc/portage/package.accept_keywords
           echo 'dev-util/gitea-runner ~amd64' > /etc/portage/package.accept_keywords/gitea-runner
 
       - name: QA scan
-        run: pkgcheck scan --repo /var/db/repos/azy5030 dev-util/gitea-runner
+        run: pkgcheck scan --repo "$GITHUB_WORKSPACE" dev-util/gitea-runner
 
       # Full source build: portage fetches the upstream source tarball and the
       # vendor tarball (release asset), verifies them against the committed
@@ -96,7 +86,7 @@ jobs:
 
       - name: Verify binary
         run: |
-          ver=$(find /var/db/repos/azy5030/dev-util/gitea-runner -name 'gitea-runner-*.ebuild' \
+          ver=$(find "$GITHUB_WORKSPACE/dev-util/gitea-runner" -name 'gitea-runner-*.ebuild' \
             | sed -E 's#.*/gitea-runner-(.*)\.ebuild#\1#' | sort -V | tail -1)
           gitea-runner --version
           gitea-runner --version | grep -q "v${ver}"