fix(ci): bookworm pip via apt, valid truthy nesting, runtime-file ignores [#784]

Red/green: run 1 failed 27s (no pip in node image); run 2 blocker was
invalid truthy nesting in .yamllint. Local repro now green.
https://projects.knownelement.com/issues/784

.gitea/workflows/ci.yml

@@ -13,7 +13,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: yamllint
         run: |
-          pip install --quiet yamllint
+          apt-get update -qq >/dev/null && apt-get install -qq -y python3-pip >/dev/null && pip install --quiet --break-system-packages yamllint
           yamllint -c .yamllint .
       - name: secret scan
         run: |

.yamllint

@@ -3,12 +3,15 @@
 extends: default
 ignore: |
   docs/
+  secrets.yaml
+  *.db
 rules:
   line-length: disable
   comments: disable
   comments-indentation: disable
   document-start: disable
-  truthy: check-keys: false
+  truthy:
+    check-keys: false
   indentation:
     spaces: consistent
     indent-sequences: consistent