refactor: use native container directive for CI jobs

Replace manual podman run invocations with the runner's container:
directive for lint, test, and secrets jobs. Cleaner step definitions,
no volume mounts needed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -9,44 +9,40 @@ on:
 jobs:
   lint:
     runs-on: linux
+    container:
+      image: python:3.12-alpine
     steps:
       - uses: actions/checkout@v4
+      - name: Install ruff
+        run: pip install --no-cache-dir -q ruff
       - name: Lint
-        run: |
-          podman run --rm \
-            -v "$PWD:/app:ro" \
-            -w /app \
-            python:3.12-alpine \
-            sh -c "pip install --no-cache-dir -q ruff && \
-                   ruff check src/ tests/"
+        run: ruff check src/ tests/
 
   test:
     runs-on: linux
     needs: [lint]
+    container:
+      image: python:3.12-alpine
     steps:
       - uses: actions/checkout@v4
-      - name: Test
+      - name: Install deps
         run: |
-          podman run --rm \
-            -v "$PWD:/app:ro" \
-            -w /app \
-            python:3.12-alpine \
-            sh -c "pip install --no-cache-dir -q -r requirements.txt && \
-                   pip install --no-cache-dir -q pytest pytest-asyncio && \
-                   PYTHONPATH=src pytest tests/ -v"
+          pip install --no-cache-dir -q -r requirements.txt
+          pip install --no-cache-dir -q pytest pytest-asyncio
+      - name: Test
+        run: PYTHONPATH=src pytest tests/ -v
 
   secrets:
     runs-on: linux
+    container:
+      image: ghcr.io/gitleaks/gitleaks:latest
+      options: --entrypoint ""
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Scan for secrets
-        run: |
-          podman run --rm \
-            -v "$PWD:/scan:ro" \
-            ghcr.io/gitleaks/gitleaks:latest \
-            detect --source /scan -v
+        run: gitleaks detect --source . -v
 
   build:
     runs-on: linux