The same runner the nightly uses. Its kernel has no Landlock, so the test's container steps around pacman's sandbox the way the ISO build does. It gets no cache volume: this workflow runs for pull requests, and a cache one of them wrote would be trusted by the next run.