CI · the platform legs match the Gitea runners; the Linux leg tests as a plain user

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -22,7 +22,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-24.04, ubuntu-24.04-arm, windows-latest, windows-11-arm, macos-15-intel]
+        # One leg per runner registered with git.zacharyzhang.com; macOS arm64 is the crate job above.
+        os: [ubuntu-24.04, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v7
@@ -30,7 +31,15 @@ jobs:
         with:
           toolchain: "1.95"
       - uses: Swatinem/rust-cache@v2
-      - run: cargo test --lib --features test-support --quiet
+      - if: runner.os != 'Linux'
+        run: cargo test --lib --features test-support --quiet
+      # The Linux job container runs as root, which ignores the file permissions the tests check.
+      - if: runner.os == 'Linux'
+        run: |
+          useradd --create-home ci
+          chmod o+x "$HOME"
+          chown -R ci "$GITHUB_WORKSPACE" "$HOME/.cargo" "$HOME/.rustup"
+          runuser -u ci -- env HOME=/home/ci CARGO_HOME="$HOME/.cargo" RUSTUP_HOME="$HOME/.rustup" PATH="$PATH"             cargo test --lib --features test-support --quiet
       - run: cargo build --example gallery
 
   site: