CI: jobs run in a container, PlatformIO directly in it, the toolchains in a volume

The runner now gives each job a container. The workflow asks for
python:3.12-slim, installs git, a compiler and PlatformIO, and mounts the
roro9stack-pio volume as the cache; the scripts skip their own docker run
when RORO_NO_DOCKER says they're in the build container already. A tag
from before the framework was rebuilt gets the stock framework libraries
back before it builds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT

.gitea/workflows/ci.yml

@@ -3,9 +3,9 @@
 #   A tag v*:          the same, then a Gitea release with the signed Update File.
 #   Run by hand:       the release of a tag that exists already (the ones from before CI).
 #
-# The runner executes jobs on its own host, where Docker is: the steps are plain shell and the build
-# runs in the project's image, exactly as scripts/ci.sh does on a developer's machine. No JavaScript
-# actions (the host has no Node), so the checkout is done with git.
+# The job runs in a plain Python image, as scripts/ci.sh does on a developer's machine, with the
+# toolchains in a Docker volume the runner allows (container.valid_volumes: roro9stack-pio): that
+# volume is the cache. No JavaScript actions, so the image needs no Node: the checkout is git.
 name: CI
 on:
   push:
@@ -19,11 +19,26 @@ on:
 
 jobs:
   build:
-    runs-on: "ubuntu://docker:ubuntu:resolute"
+    runs-on: ubuntu
+    container:
+      image: python:3.12-slim
+      volumes:
+        - roro9stack-pio:/pio
+    env:
+      PLATFORMIO_CORE_DIR: /pio
+      RORO_NO_DOCKER: 1
     steps:
+      - name: Tools
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq --no-install-recommends git build-essential openssl >/dev/null
+          pip install -q --no-cache-dir --root-user-action=ignore platformio
+          pio --version; df -h /pio | tail -1; ls /pio | head
+
       - name: Check out
         run: |
           find . -mindepth 1 -maxdepth 1 -exec rm -rf {} +
+          git config --global --add safe.directory '*'
           git init -q .
           git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
           git fetch -q --tags origin '+refs/heads/*:refs/remotes/origin/*'
@@ -49,16 +64,16 @@ jobs:
           OTA_SIGNING_KEY: ${{ secrets.OTA_SIGNING_KEY }}
         run: |
           # The sources of the tag in a clone of their own; the tools are this commit's.
-          rm -rf ../release-src dist
-          git clone -q . ../release-src
-          git -C ../release-src checkout -q --detach "refs/tags/${{ steps.release.outputs.tag }}"
-          # The key exists as a file only while this step runs.
+          rm -rf /tmp/release-src dist
+          git clone -q . /tmp/release-src
+          git -C /tmp/release-src checkout -q --detach "refs/tags/${{ steps.release.outputs.tag }}"
+          # The key exists as a file only while this step runs, in a container that goes with the job.
           umask 077
           export RORO_OTA_KEY="$(mktemp)"
           trap 'rm -f "$RORO_OTA_KEY"' EXIT
           printf '%s\n' "$OTA_SIGNING_KEY" > "$RORO_OTA_KEY"
           umask 022
-          scripts/release_build.sh ../release-src dist
+          scripts/release_build.sh /tmp/release-src dist
 
       - name: Publish the release
         if: steps.release.outputs.tag != ''