ci: warm the action cache before parallel jobs to fix runner flake

At runner capacity > 1 the pnpm jobs (checks, auth-e2e, fidelity) start
together and fetch the same actions (checkout, setup-node,
pnpm/action-setup) into the shared offline action cache simultaneously,
reading it half-written — a flaky "Cannot find module .../dist/…" in
"Set up Node.js"/"Set up pnpm" that hit three pushes in a row after the
capacity increase. A tiny `prepare` job now runs those actions once,
alone, populating the cache; checks/auth-e2e/fidelity/images depend on it
and only read the complete cache. Keeps full parallelism after the ~30 s
warm-up.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1

.gitea/workflows/ci.yml

@@ -13,8 +13,29 @@ on:
     branches: [main]
 
 jobs:
+  # Warm the runner's shared action cache once, alone, before the parallel
+  # pnpm jobs start. With the runner at capacity > 1, several jobs otherwise
+  # fetch the same actions (checkout, setup-node, pnpm/action-setup) into the
+  # shared offline cache simultaneously and read it half-written — a flaky
+  # "Cannot find module .../dist/…" in "Set up Node.js"/"Set up pnpm". Running
+  # these actions once here populates the cache completely; the dependent jobs
+  # then only read it. Cheap (~30 s) and keeps full parallelism afterwards.
+  prepare:
+    name: Warm action cache
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
   checks:
     name: Lint, typecheck, test
+    needs: prepare
     runs-on: ubuntu-latest
     services:
       postgres:
@@ -65,6 +86,7 @@ jobs:
   # already-built-and-seeded stack, instead of spinning up a second one.
   auth-e2e:
     name: Auth e2e pack
+    needs: prepare
     runs-on: ubuntu-latest
     services:
       postgres:
@@ -355,6 +377,7 @@ jobs:
   # job (no sidecars there).
   fidelity:
     name: Import/export fidelity gate
+    needs: prepare
     runs-on: ubuntu-latest
     # A guard so a hung sidecar can never keep the job (and its containers)
     # alive on the shared runner host; the suite itself finishes in ~1 min.
@@ -435,6 +458,7 @@ jobs:
 
   images:
     name: Build container images
+    needs: prepare
     # PR-only: on main the CD workflow builds and pushes the same images —
     # building twice would waste the runner (ADR 0014: build once, promote).
     if: github.event_name == 'pull_request'