ci: v4 builtin:checkout in ci + release (no Node, no token-in-URL)

builtin:checkout is native Go, so the rust:1 container needs no Node and the
job token no longer rides in the fetch URL (was visible in process args).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -19,17 +19,10 @@ jobs:
       matrix:
         target: [x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu]
     steps:
-      # Not the checkout action: it runs on node, which the rust:1 job
-      # container doesn't have and this runner doesn't inject (the v5
-      # run died with 'exec: "node": not found'). Plain git needs
-      # neither, and the token URL works against the private repo.
+      # v4 built-in checkout: native Go, needs no Node (rust:1 has none) and
+      # keeps the token out of a fetch URL. Uses the job token for the private repo.
       - name: checkout
-        run: |
-          git init -q .
-          git fetch --depth 1 \
-            "https://gitea:${{ secrets.GITHUB_TOKEN }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" \
-            "$GITHUB_SHA"
-          git checkout -q FETCH_HEAD
+        uses: builtin:checkout
 
       - name: install tooling
         run: |