build.sh: write pmbootstrap config directly; propagate errors; keep checkout root-owned

'pmbootstrap config' demands an existing config file, so write
pmbootstrap_v3.cfg ourselves (INI, aports/device/ui/systemd). Explicit
set -eu because 'sh script' ignores shebang flags - run 3 shipped a
3.5KB 'image' because failures didn't propagate. dist/ is now the only
build-user-owned path, so the tag step's git works again.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.forgejo/workflows/build.yml

@@ -43,6 +43,7 @@ jobs:
 
       - name: Update rolling 'latest' tag
         run: |
+          git config --global --add safe.directory "$PWD"
           git config user.email "ci@catcrafts.net"
           git config user.name "fp6-img CI"
           git tag -f latest