fix: install node in job containers so actions/checkout can exec

actions/checkout@v4 is a JS action; Forgejo Actions runs it via node, which
neither golang:1.25-bookworm nor docker:27-cli ship. Every run since the
.gitea/workflows move has failed identically: 'exec: node: executable file
not found in $PATH' during the checkout step, before any real job step ran.

Verified locally against both exact images before pushing:
- golang:1.25-bookworm: apt-get install nodejs ca-certificates git -> node
  v18.20.4, git 2.39.5.
- docker:27-cli: apk add nodejs git -> node v22.23.2, git 2.47.2, and
  actions/checkout's dist/index.js actually executes afterward (confirmed
  by invoking it directly) instead of failing on a missing binary.
- The Dockerfile itself builds clean end to end and the resulting image
  serves /healthz, so checkout was the only remaining blocker in the path.

.gitea/workflows/build.yaml

@@ -27,6 +27,17 @@ jobs:
       DOCKER_TLS_VERIFY: "1"
       DOCKER_CERT_PATH: /docker-certs/client
     steps:
+      # actions/checkout@v4 is a JS action -- Forgejo Actions execs it with
+      # `node`, which docker:27-cli (Alpine) doesn't ship. Without this the
+      # checkout step fails with "exec: node: executable file not found in
+      # $PATH" before any of the job's own steps run. Verified locally:
+      # `apk add --no-cache nodejs git` in this exact image gets node v22 +
+      # git 2.47, and the checkout action's dist/index.js then actually
+      # executes (confirmed by running it directly) instead of failing on a
+      # missing binary.
+      - name: install node (required by JS-based actions)
+        run: apk add --no-cache nodejs git
+
       - uses: actions/checkout@v4
 
       - name: Get short SHA

.gitea/workflows/ci.yaml

@@ -28,6 +28,14 @@ jobs:
     container:
       image: golang:1.25-bookworm
     steps:
+      # actions/checkout@v4 is a JS action -- Forgejo Actions execs it with
+      # `node`, which golang:1.25-bookworm doesn't ship. Without this the
+      # checkout step fails with "exec: node: executable file not found in
+      # $PATH" before any of the job's own steps run. Same fix already in use
+      # in kmsvc-manage's ci.yaml; carried over here.
+      - name: install node (required by JS-based actions)
+        run: apt-get update && apt-get install -y --no-install-recommends nodejs ca-certificates git
+
       - uses: actions/checkout@v4
 
       - name: go vet