rm -rf $GITHUB_WORKSPACE deleted the runner's own working directory,
breaking git clone (fatal: Unable to read current working directory).
Clone into $GITHUB_WORKSPACE/repo instead.
The workflow assumed $GITHUB_WORKSPACE was already a git repo, but the
host-mode runner doesn't auto-checkout. Added an explicit clone step using
the runner's deploy key (gitea@giteassh.buzzbee.dev).