ci: attach build-iso job to DinD network, pin lychee-action source

- build-iso: the job container was on a per-job docker network, so
  `docker-in-docker` (the DinD sidecar hostname on
  `forgejo-runner_default`) didn't resolve. Pin the container to that
  shared network via `container.options: --network forgejo-runner_default`.
  catthehacker/ubuntu:act-latest already has the docker CLI, so drop
  the apt-get step.

- ci.yml markdown-links: forgejo's action mirror at data.forgejo.org
  doesn't carry `lycheeverse/lychee-action`, so `uses:` was 404ing
  before the step could even run (rendering continue-on-error moot).
  Fully-qualified GitHub URL bypasses the mirror.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.forgejo/workflows/build-iso.yml

@@ -16,20 +16,19 @@ jobs:
   build-iso:
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    # Attach the job container to `forgejo-runner_default` so the
+    # `docker-in-docker` hostname (the DinD sidecar) is DNS-resolvable.
+    # Without this the job runs on its own per-job network and DOCKER_HOST
+    # resolves nowhere. catthehacker/ubuntu:act-latest already ships
+    # docker CLI, so we don't need to apt-install anything.
+    container:
+      image: catthehacker/ubuntu:act-latest
+      options: --network forgejo-runner_default
     env:
-      # forgejo-runner's DinD sidecar is reachable over TCP on the
-      # `forgejo-runner_default` docker network. The default runner image
-      # for `ubuntu-latest` doesn't propagate the runner's docker_host
-      # config into the job env, so we pin it explicitly here.
       DOCKER_HOST: tcp://docker-in-docker:2375
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install docker CLI
-        run: |
-          apt-get update -qq
-          apt-get install -y --no-install-recommends docker.io
-
       - name: Build ISO
         run: ./iso/build.sh
 

.forgejo/workflows/ci.yml

@@ -53,7 +53,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Check markdown links
-        uses: lycheeverse/lychee-action@v2
+        # Fully-qualified URL because forgejo's default action mirror
+        # (data.forgejo.org) doesn't carry lycheeverse/lychee-action.
+        uses: https://github.com/lycheeverse/lychee-action@v2
         with:
           args: --verbose --no-progress --max-concurrency 4 './**/*.md'
           fail: false