fix(docker): drop /var/run symlink from chisel rootfs for Kaniko

The runtime stage copies the chisel rootfs onto `/` in a scratch stage.
chisel ships /var/run as a symlink to /run; Kaniko replacing it forces a
RemoveAll of the destination /var/run, which on the Forgejo act runner
holds a busy /var/run/act bind-mount -> 'unlinkat ... device or resource
busy'. The image does not need /var/run, so remove the symlink.

Dockerfile

@@ -62,6 +62,14 @@ RUN useradd --root /rootfs -u 1000 -U -M -s /bin/false brewlog \
     && mkdir -p /rootfs/home/brewlog /rootfs/data \
     && chown 1000:1000 /rootfs/home/brewlog /rootfs/data
 
+# chisel's base-files ships /var/run as a symlink to /run. When the CI builder
+# (Kaniko) lays this rootfs onto `/` for the scratch stage, replacing that
+# symlink forces a RemoveAll of the destination /var/run — which on the Forgejo
+# act runner is a directory holding a busy /var/run/act bind-mount, so the copy
+# fails with "unlinkat /var/run/act: device or resource busy". The runtime image
+# does not need /var/run, so drop the symlink to avoid the collision.
+RUN rm -rf /rootfs/var/run
+
 # ---------------------------------------------------------------------------
 # Runtime — scratch with chisel rootfs
 # ---------------------------------------------------------------------------