Bound every await in push_to; plain-git checkout for real this time

CI (run 208) showed the Push RPC hanging past the test client's 120s
read timeout: endpoint.connect and the delivery-verification observe
loop had no bounds, so a wedged path hung the socket instead of
failing. Connect now times out at 30s and each observe step at 60s,
producing structured errors that name the stage.

The checkout action is back out: run 212 proved the failure is not the
action's version — the runner execs the action's JS with node inside
the job container, and rust:1 has no node ('exec: "node": executable
file not found'). Plain git needs nothing the container lacks.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -12,7 +12,17 @@ jobs:
     runs-on: ubuntu-latest
     container: rust:1
     steps:
-      - uses: actions/checkout@v5
+      # Not the checkout action: it runs on node, which the rust:1 job
+      # container doesn't have and this runner doesn't inject (the v5
+      # run died with 'exec: "node": not found'). Plain git needs
+      # neither, and the token URL works against the private repo.
+      - name: checkout
+        run: |
+          git init -q .
+          git fetch --depth 1 \
+            "https://gitea:${{ secrets.GITHUB_TOKEN }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" \
+            "$GITHUB_SHA"
+          git checkout -q FETCH_HEAD
       - name: rustfmt
         run: |
           rustup component add rustfmt