Many imorovments

.gitea/workflows/build-and-test.yml

@@ -14,6 +14,11 @@ jobs:
   desktop:
     runs-on: linux/amd64
     name: Desktop (Linux)
+    # actions/checkout and actions/cache are JavaScript actions: the runner
+    # executes them with Node from inside this container. The bare runner image
+    # has none, so the job failed at checkout before reaching any build step.
+    container:
+      image: catthehacker/ubuntu:act-latest
 
     steps:
       - name: Checkout
@@ -34,6 +39,17 @@ jobs:
           apt-get update -qq
           apt-get install -y -qq pkg-config libfontconfig1-dev libxkbcommon-dev
 
+      # The act image ships Node but no Rust. Pinned to the workspace
+      # rust-version so CI, the Android image, and local builds agree — a
+      # floating toolchain turns an unrelated push into a mystery failure.
+      - name: Install Rust 1.92.0
+        run: |
+          set -e
+          curl -fsSL https://sh.rustup.rs | sh -s -- \
+            -y --no-modify-path --profile minimal \
+            --default-toolchain 1.92.0 --component rustfmt,clippy
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
       - name: Format
         run: cargo fmt --all -- --check
 
@@ -92,11 +108,23 @@ jobs:
   layering:
     runs-on: linux/amd64
     name: Layer separation
+    # Node for the JS actions, as above. cargo comes from rustup below.
+    container:
+      image: catthehacker/ubuntu:act-latest
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      # `cargo tree` resolves the dependency graph, so it needs the registry
+      # index but no system libraries — this job builds nothing.
+      - name: Install Rust 1.92.0
+        run: |
+          set -e
+          curl -fsSL https://sh.rustup.rs | sh -s -- \
+            -y --no-modify-path --profile minimal --default-toolchain 1.92.0
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
       # ARCH §6.5a: no core/ crate may depend on the UI toolkit. One stray
       # `use slint::` costs headless golden-image testing and the
       # one-operation-two-presentations property together, and nothing else

.gitea/workflows/traceability-check.yml

@@ -23,6 +23,10 @@ jobs:
   traceability:
     runs-on: linux/amd64
     name: Requirement traces
+    # Node for actions/checkout and actions/cache, which the bare runner image
+    # cannot execute. Rust is installed below.
+    container:
+      image: catthehacker/ubuntu:act-latest
 
     steps:
       - name: Checkout
@@ -39,6 +43,15 @@ jobs:
             target
           key: traces-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
 
+      # Source-comment and markdown parsing only, so the minimal profile is
+      # enough — no system libraries and no components beyond cargo itself.
+      - name: Install Rust 1.92.0
+        run: |
+          set -e
+          curl -fsSL https://sh.rustup.rs | sh -s -- \
+            -y --no-modify-path --profile minimal --default-toolchain 1.92.0
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
       # The gate's own arithmetic is the thing being trusted, so its tests run
       # before it does. Untested gate logic is exactly how JellyTau's 158% went
       # unnoticed for months.