publish: writable cargo home for the iris build step

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4jrCgLiKKHAEFuZUJjckH

.gitea/workflows/publish.yml

@@ -64,6 +64,11 @@ jobs:
       # matches; shipping it in the tarball keeps a site that pins nothing
       # extra lint-capable at /srv/app/<instance>/current/iris.
       - name: Build iris
+        env:
+          # The shared cargo home is read-only for the runner, and a git
+          # dependency has to be cloned into one (same as uhhm/iris's CI).
+          CARGO_HOME: /var/local/cargo-target/iris-cargo-home
+          RUSTC_WRAPPER: /usr/bin/sccache
         run: cargo install --git "${{ github.server_url }}/uhhm/iris.git" --tag "$IRIS_RELEASE" --root "$CARGO_TARGET_DIR/iris-install" --force iris
 
       - name: Package

CHANGELOG.md

@@ -4,6 +4,10 @@ One line per change, grouped by the release that shipped it. Newest
 first. A release is a Cargo.toml bump plus a `v<version>` tag; the
 content repos pin the tag they run (see the end of this file).
 
+## Unreleased
+
+- publish: the iris build step gets a writable cargo home; the v0.3.37 tag never published
+
 ## 0.3.37 (2026-09-22)
 
 - The lint moves to its own repo, uhhm/iris: `question_lint` becomes `iris check`, `needs_replay` becomes `iris replay`; the tarball ships `iris` (pinned in publish.yml) instead of `question_lint`; the needs module and local loaders leave portal