Target Gitea runner label Main

Change runs-on to the "Main" label used by Act Runner 1, and make the
toolchain install step work both as root (default in act_runner
containers) and on hosts where sudo is required.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -34,7 +34,8 @@ on:
 
 jobs:
   build-release:
-    runs-on: ubuntu-latest
+    # 对应 Gitea Runner "Act Runner 1" 的标签
+    runs-on: Main
     steps:
       - name: Checkout (full history)
         uses: actions/checkout@v4
@@ -44,9 +45,14 @@ jobs:
       - name: Install toolchain
         run: |
           set -euo pipefail
-          sudo apt-get update -qq
+          if [[ $EUID -ne 0 ]] && command -v sudo >/dev/null 2>&1; then
-          DEBIAN_FRONTEND=noninteractive sudo apt-get install -y -qq \
+            SUDO=sudo
-            shellcheck jq curl tar coreutils
+          else
+            SUDO=
+          fi
+          $SUDO apt-get update -qq
+          DEBIAN_FRONTEND=noninteractive $SUDO apt-get install -y -qq \
+            shellcheck jq curl tar coreutils ca-certificates
 
       - name: Run shellcheck
         run: |