fix(deploy): the CI runner unpacks Flutter's Gradle wrapper

The night's run failed at its dependencies: tar couldn't make
gradle/wrapper in Flutter's cache ("Cannot mkdir: Function not
implemented"). The unit's RestrictSUIDSGID= filter can't see the mode
inside openat2's argument, so it refuses openat2 altogether with ENOSYS,
and GNU tar 1.35 enters each folder it unpacks through openat2 with
RESOLVE_BENEATH, without falling back. Reproduced on a laptop with that
setting alone under systemd-run, strace showing the refused openat2.

The setting goes, with a comment saying why: NoNewPrivileges= and the
empty capability set keep a set-user-ID file from raising anything in
the sandbox, and one the runner made is its own, in its 0700 folder.
The host takes the unit as deploy/host/README.md's step 7 installs it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/runner/forgejo-runner.service

@@ -68,7 +68,11 @@ NoNewPrivileges=yes
 CapabilityBoundingSet=
 AmbientCapabilities=
 SystemCallArchitectures=native
-RestrictSUIDSGID=yes
+# No RestrictSUIDSGID=: its filter can't see the mode inside openat2's argument, so it
+# refuses openat2 altogether (ENOSYS), and GNU tar 1.35 enters every folder it unpacks
+# through openat2 without falling back: Flutter's Gradle wrapper failed to unpack (found
+# 12 Nov 2026). NoNewPrivileges= and the empty capability set keep a set-user-ID file
+# from raising anything here, and one the runner made is its own, in its 0700 folder.
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
 ProtectKernelLogs=yes