The workflow ran on `crafter-flatpak`, Crafter.Build's own runner, which
is registered to that repository alone, so it never ran here. It runs on
the Catcrafts organisation's privileged `flatpak` runner now, split by
trust the way imsd-messages' workflow is: `check` builds a pull request
or a run by hand on another branch cold, with no host volume, because
such a job runs as root in a privileged container; `publish` builds
master and releases it, mounting the crafter-build installation the
publish jobs share (crafter-flatpak-org-system), the published
repository and its signing key. flatpak-builder's state stays in the
workspace, so every run builds cold. AGENTS says so.
Jorijn van der Graaf
443b9ce960