fix(ci): give the unclaim step a CA bundle

Second defect in the same workflow. The shell fix took -- the step ran
under `bash --noprofile --norc -e -o pipefail` -- and got one layer
further before failing:

  curl: (77) error setting certificate file: /etc/ssl/certs/ca-certificates.crt

ubuntu:24.04 ships no CA bundle, and --no-install-recommends skips the
ca-certificates that curl recommends, so curl came up unable to verify
TLS against our own Gitea.

This was avoidable by reading the repo rather than reasoning about it:
ci.yml (twice), desktop-assets.yml, android-apk.yml and release.yml all
spell out `ca-certificates curl ... jq` for exactly this reason. The
convention was written down five times already.

Validated in the real image this time rather than by extracting the
script and running it on the host, which is what missed this: the step
now succeeds inside `docker run ubuntu:24.04` against a scratch issue --
label present, 204, label gone -- and the previous version reproduces
`curl: (77)` in the same image. Both checked, then the scratch issue was
deleted.

The DELETE also keeps its response body now and prints it on a non-204.
Whether the automatic token carries issue-write scope is still unproven,
because both failures happened before the API call, and "403" without
Gitea's own sentence would cost another merge to interpret.

Closes #102

.gitea/workflows/unclaim.yml

@@ -58,8 +58,15 @@ jobs:
         run: |
           set -euo pipefail
 
+          # `ca-certificates` is named because `--no-install-recommends`
+          # skips it, and `ubuntu:24.04` ships no CA bundle of its own —
+          # so curl comes up unable to verify TLS against our own Gitea
+          # and fails with "error setting certificate file" (exit 77).
+          # Every other containerised workflow here spells it out for the
+          # same reason; this one did not, and cost a release cycle.
           apt-get update -qq
-          apt-get install -y -qq --no-install-recommends curl jq >/dev/null
+          apt-get install -y -qq --no-install-recommends \
+            ca-certificates curl jq >/dev/null
 
           label_id=$(
             curl -sSf -H "Authorization: token $TOKEN" "$API/labels?limit=100" |
@@ -78,8 +85,14 @@ jobs:
           # label answers the same as one that did, which is what makes
           # this safe to run on *every* close rather than only the ones
           # that were claimed.
+          # The body is captured, not discarded, so a refusal is
+          # diagnosable from this log alone.  Whether the automatic
+          # token carries issue-write scope is still unproven, and
+          # "DELETE returned 403" without Gitea's own sentence costs
+          # another merge to find out which of the two it is.
+          body=$(mktemp)
           code=$(
-            curl -sS -o /dev/null -w '%{http_code}' -X DELETE \
+            curl -sS -o "$body" -w '%{http_code}' -X DELETE \
               -H "Authorization: token $TOKEN" \
               "$API/issues/$ISSUE/labels/$label_id"
           )
@@ -88,6 +101,7 @@ jobs:
             204) echo "unclaim: #$ISSUE is closed and unclaimed" ;;
             *)
               echo "unclaim: DELETE returned $code for #$ISSUE" >&2
+              cat "$body" >&2
               exit 1
               ;;
           esac