ci: check out via actions/checkout (repo is SHA-1, not SHA-256)

Run 110's lint job failed at checkout ("couldn't find remote ref <sha>")
because GIT_DEFAULT_HASH: sha256 — copied from the SHA-256 homeserver repo —
made git init create a SHA-256 repo that can't resolve this repo's SHA-1
commits. This overlay is a plain SHA-1 repo, so checkout needs no hash override.

- lint job: drop the bogus GIT_DEFAULT_HASH: sha256 override.
- build job: replace the curl+tar checkout with actions/checkout into
  $GITHUB_WORKSPACE, registered with portage via repos.conf; pull dev-vcs/git
  in Configure portage (stage3 has no git, which checkout shells out to) and
  drop net-misc/curl (only the old checkout used it). QA scan / verify steps
  now reference $GITHUB_WORKSPACE.
- CLAUDE.md: correct the SHA-256 claim and rewrite the CI section for the
  two-job lint-gate + actions/checkout setup.

just lint passes; ci.yaml passes actionlint.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS

CLAUDE.md

@@ -7,8 +7,10 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 A personal **Gentoo ebuild repository (overlay)**, repo name `azy5030`, EAPI 8,
 `masters = gentoo`, thin + unsigned Manifests (`metadata/layout.conf`). It packages
 software not in the main `::gentoo` tree. Currently one package:
-`dev-util/gitea-runner`. Hosted on a self-hosted Gitea at `git.azy.dev` whose repos
-use SHA-256 object format.
+`dev-util/gitea-runner`. Hosted on a self-hosted Gitea at `git.azy.dev`. (This repo
+is a standard SHA-1 repo; the sibling `homeserver` repo is SHA-256, so workflow
+snippets copied from it may carry a `GIT_DEFAULT_HASH: sha256` checkout override
+that this repo must *not* use.)
 
 ## The vendored-build model (the core design)
 
@@ -58,11 +60,14 @@ a Gentoo env with `go pkgdev git curl xz jq`.
 
 ## CI (`.gitea/workflows/ci.yaml`)
 
-Runs on every push inside a `gentoo/stage3:amd64-openrc` container (the `runs-on` label
-only schedules onto the Docker-backend runner). Steps: `emerge-webrsync` to sync
-`::gentoo` → configure portage (disables binpkg signature verification so prebuilt deps
-like `dev-lang/go` are pulled, not compiled) → **check out via `curl + tar`, not
-`actions/checkout`** (it breaks on SHA-256 Gitea repos) into `/var/db/repos/azy5030` →
+Runs on every push, two jobs. A **`lint`** job runs on the plain Docker-backend runner
+(no container), checks out with `actions/checkout`, installs the linters, and runs
+`just lint` (markdownlint/shellcheck/yamllint/actionlint). The **`build`** job has
+`needs: lint` (lint is a gate) and runs inside a `gentoo/stage3:amd64-openrc` container:
+`emerge-webrsync` to sync `::gentoo` → configure portage (disables binpkg signature
+verification so prebuilt deps like `dev-lang/go` are pulled, not compiled; also pulls
+`dev-vcs/git`, which `actions/checkout` needs and stage3 lacks) → `actions/checkout`
+into `$GITHUB_WORKSPACE`, registered as the overlay via `repos.conf` →
 `pkgcheck scan` → `emerge` → assert `gitea-runner --version` matches the ebuild version.
 
 ## Conventions / gotchas