CI: never install packages on bare runners — check deps, install only in containers

Bare runners are real hosts; pacman -Sy in CI mutates them (and can leave a
partial-sync state). Now the ephemeral container runner installs its deps as
before, while the bare (aarch64/klokka) runner is only checked for
libpipewire+clang and fails with a clear message if they're absent.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GLUwWE2KmFPzhKaf67tWbx

.gitea/workflows/release.yml

@@ -36,14 +36,23 @@ jobs:
           path: ~/.cargo/registry
           key: ${{ runner.os }}-${{ matrix.arch }}-cargo-${{ hashFiles('Cargo.lock') }}
 
-      - name: Install audio build deps (libpipewire + clang for native capture)
+      - name: Ensure audio build deps (libpipewire + clang for native capture)
         run: |
-          SUDO=""; command -v sudo >/dev/null && SUDO=sudo
           if command -v apt-get >/dev/null; then
+            # Ephemeral container runner: safe to install into it.
+            SUDO=""; command -v sudo >/dev/null && SUDO=sudo
             $SUDO apt-get update
             $SUDO apt-get install -y libpipewire-0.3-dev libspa-0.2-dev clang libclang-dev pkg-config
-          elif command -v pacman >/dev/null; then
+          else
-            $SUDO pacman -Sy --needed --noconfirm pipewire clang pkgconf
+            # Bare/host runner: never mutate it - require deps preinstalled.
+            missing=""
+            pkg-config --exists libpipewire-0.3 2>/dev/null || missing="$missing libpipewire(+dev headers)"
+            command -v clang >/dev/null || missing="$missing clang"
+            if [ -n "$missing" ]; then
+              echo "::error::bare runner missing build deps:$missing — install once on the host; CI does not modify bare runners"
+              exit 1
+            fi
+            echo "bare runner already has libpipewire + clang"
           fi
 
       - name: Build