Run Sized Linux checks on the existing Gitea runner

scripts/check-linux-container.sh

@@ -10,8 +10,9 @@ cargo --version
 # Only source inputs are copied. Cargo output and all fixtures disappear with
 # the container; the host checkout is read-only and no personal tree is scanned.
 check_root=$(mktemp -d /tmp/sized-check.XXXXXX)
-cp /source/Cargo.toml /source/Cargo.lock "$check_root/"
-cp -R /source/src /source/tests /source/benches "$check_root/"
+source_root=${SIZED_TEST_SOURCE:-/source}
+cp "$source_root/Cargo.toml" "$source_root/Cargo.lock" "$check_root/"
+cp -R "$source_root/src" "$source_root/tests" "$source_root/benches" "$check_root/"
 cd "$check_root"
 cargo fmt --all -- --check
 cargo test --locked

scripts/gitea-linux.Dockerfile

@@ -0,0 +1,10 @@
+# Node supports the pinned checkout action; application code remains Rust.
+FROM node:24-bookworm@sha256:934240a162082fd8b8a2f90cd5114446443f1eba1c5378f6687167ca405e6584 AS node-runtime
+FROM rust:1.88.0-bookworm@sha256:af306cfa71d987911a781c37b59d7d67d934f49684058f96cf72079c3626bfe0
+RUN rustup component add rustfmt clippy
+COPY --from=node-runtime /usr/local/bin/node /usr/local/bin/node
+# A new runner workspace volume inherits this ownership. No setuid step or
+# Docker socket is needed in jobs, even with all capabilities dropped.
+RUN mkdir -p /workspace && chown 65532:65532 /workspace
+USER 65532:65532
+WORKDIR /workspace