fix: simplify CI workflows to run directly on runner without nested containers

- Remove container blocks causing Docker-in-Docker permission issues
- Use actions/checkout@v4 instead of manual git cloning
- Use actions/setup-python@v5 and actions/setup-node@v4 for clean environments
- Remove nsenter workarounds and mount complexity
- Fix volume paths to use /volume1/docker/* directly
- Add /volume1/docker/claude-dev to runner valid_volumes config

This eliminates 20+ commits of permission/namespace hacks by letting
workflows run directly in the runner's environment which already has
Docker access and proper volume mounts configured.

.gitea/workflows/deploy-claude-dev-dev.yml

@@ -18,18 +18,9 @@ concurrency:
 jobs:
   deploy-claude-dev-dev:
     runs-on: ubuntu-latest
-    container:
-      volumes:
-        - /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
-        - /volume1/docker/claude-dev:/claude-dev-runtime
     steps:
-      - name: Checkout exact commit
-        run: |
-          set -euo pipefail
-          git init .
-          git remote add origin http://gitea:3000/jimmy/nas-tools.git
-          git fetch --depth 1 origin "$GITHUB_SHA"
-          git checkout --detach FETCH_HEAD
+      - name: Checkout repository
+        uses: actions/checkout@v4
 
       - name: Resolve image tags
         run: |
@@ -89,10 +80,10 @@ jobs:
       - name: Record previous image
         run: |
           set -euo pipefail
-          mkdir -p /claude-dev-runtime
+          mkdir -p /volume1/docker/claude-dev
           previous_image="$(docker inspect -f '{{.Config.Image}}' claude-dev 2>/dev/null || true)"
           if [ -n "$previous_image" ]; then
-            printf '%s\n' "$previous_image" > /claude-dev-runtime/previous-image.txt
+            printf '%s\n' "$previous_image" > /volume1/docker/claude-dev/previous-image.txt
             echo "Saved previous image: $previous_image"
           else
             echo "No existing claude-dev container found"
@@ -101,8 +92,8 @@ jobs:
       - name: Sync compose and target tag
         run: |
           set -euo pipefail
-          cp claude-dev/docker-compose.yml /claude-dev-runtime/docker-compose.yml
-          printf '%s\n' "$CLAUDE_DEV_IMAGE_TAG" > /claude-dev-runtime/target-tag.txt
+          cp claude-dev/docker-compose.yml /volume1/docker/claude-dev/docker-compose.yml
+          printf '%s\n' "$CLAUDE_DEV_IMAGE_TAG" > /volume1/docker/claude-dev/target-tag.txt
 
       - name: Remove stale claude-dev container
         run: docker rm -f claude-dev || true
@@ -110,7 +101,7 @@ jobs:
       - name: Deploy claude-dev
         run: |
           set -euo pipefail
-          CLAUDE_DEV_IMAGE_TAG="$CLAUDE_DEV_IMAGE_TAG" docker compose -f /claude-dev-runtime/docker-compose.yml up -d --pull never
+          CLAUDE_DEV_IMAGE_TAG="$CLAUDE_DEV_IMAGE_TAG" docker compose -f /volume1/docker/claude-dev/docker-compose.yml up -d --pull never
 
       - name: Post-deploy runtime checks
         run: |