probe round 2: install-test on ubuntu-docker, Trivy without setup-trivy

Round 1 measured: install-test dies on ubuntu-latest at 'Create k3d
cluster' with 'Cannot connect to the Docker daemon', and trivy-config
dies inside aquasecurity/setup-trivy, which checks out
aquasecurity/trivy from github.com with the Gitea github.token.
This round tests both fixes and prints the runner facts.

.github/workflows/validate-charts.yml

@@ -199,11 +199,25 @@ jobs:
         uses: actions/checkout@v7
       - name: "Install Helm"
         uses: azure/setup-helm@v5
+      # A plain release download rather than aquasecurity/setup-trivy, measured
+      # on the Gitea probe run of #225. That action runs actions/checkout
+      # against aquasecurity/trivy on github.com and hands it `github.token` -
+      # which on Gitea is a GITEA token. github.com answers 401, checkout
+      # retries twice and ends with "fatal: could not read Username for
+      # 'https://github.com': terminal prompts disabled", an error naming
+      # neither the action nor the token. Its actions/cache step is dead on the
+      # instance as well ("Cache action is only supported on GHES version >=
+      # 3.5"), and fetching the nested actions cost 4m30s before the job even
+      # started. One tarball behaves the same on both platforms, and the
+      # Renovate comment above still keeps TRIVY_VERSION current.
       - name: "Install Trivy"
-        uses: aquasecurity/setup-trivy@v0.3.1
-        with:
-          version: ${{ env.TRIVY_VERSION }}
-          cache: true
+        run: |
+          curl -sSfL -o /tmp/trivy.tar.gz \
+            "https://github.com/aquasecurity/trivy/releases/download/${TRIVY_VERSION}/trivy_${TRIVY_VERSION#v}_Linux-64bit.tar.gz"
+          mkdir -p "$HOME/.local/bin"
+          tar -xzf /tmp/trivy.tar.gz -C "$HOME/.local/bin" trivy
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+          "$HOME/.local/bin/trivy" --version
       # Findings land in the job summary, not only in the log: exceptions with
       # their reasons come from ci/trivy/trivyignore.yaml, the trusted-registry
       # list from ci/trivy/data/ksv0125.yaml.
@@ -214,7 +228,23 @@ jobs:
     name: "Install-test ${{ matrix.chart }}"
     needs: [detect-changed-charts, build-chart]
     if: needs.detect-changed-charts.outputs.any-install == 'true'
-    runs-on: ubuntu-latest
+    # NOT ubuntu-latest, and the one job in this repo that deviates. This is
+    # the only job that needs a Docker socket - it creates a k3d cluster, and
+    # k3d is a docker client. On GitHub's hosted runners every label carries
+    # Docker, so the distinction never came up; on the Gitea instance this repo
+    # is moving to (#225) the labels mean different machines: `ubuntu-latest`
+    # has no socket, `ubuntu-docker` has. Measured on the probe PR, not
+    # assumed - on ubuntu-latest the step "Create k3d cluster" fails with
+    # "Cannot connect to the Docker daemon at unix:///var/run/docker.sock",
+    # an error that points at k3d and never at the runner label. Every other
+    # job here (lint/package, the quantity render, the Trivy config scan) was
+    # measured green on ubuntu-latest and stays there.
+    #
+    # The label is unknown to GitHub Actions. While this repo still builds on
+    # github.com the job therefore stays queued - that is the intended state
+    # for the window in which CI is being handed over, and it is the reason
+    # this line must not be "corrected" back to ubuntu-latest.
+    runs-on: ubuntu-docker
     # Blocking since Renovate automerges patch/minor updates: a chart that no
     # longer starts must stop the PR before it reaches main and publishes. This
     # ends the stabilization phase of issue #22 - the job reported failures
@@ -288,6 +318,20 @@ jobs:
           : "${FREESAILARR_WG_KEY:?empty - check op://GitHub-Actions/freesailarr-mullvad-test-config/credential}"
           : "${FREESAILARR_WG_ADDRESSES:?empty - check op://GitHub-Actions/freesailarr-mullvad-test-config/ip-address}"
           echo "Both VPN values arrived non-empty."
+      - name: "PROBE runner facts (remove before merge)"
+        run: |
+          echo "labels/runner: ${RUNNER_NAME:-?}  os=${RUNNER_OS:-?} arch=${RUNNER_ARCH:-?}"
+          echo "nproc: $(nproc)"
+          free -m || true
+          df -h / || true
+          echo "--- docker ---"
+          docker version || echo "NO DOCKER CLIENT/DAEMON"
+          docker info --format '{{.ServerVersion}} storage={{.Driver}} cpus={{.NCPU}} mem={{.MemTotal}}' || echo "docker info FAILED"
+          echo "--- toolchain ---"
+          node --version || echo "no node"
+          npx --version || echo "no npx"
+          python3 --version || echo "no python3"
+          git --version; curl --version | head -1
       - name: "Install k3d"
         run: curl -sSfL https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | TAG="$K3D_VERSION" bash
       - name: "Create k3d cluster"