ci: fix python-lint job for containers without node (manual clone)

.gitea/workflows/ci.yml

@@ -73,6 +73,8 @@ jobs:
 
   # Ruff lint on the FastAPI backend (config in ruff.toml). Replaces the old
   # flake8 `|| true` npm script that never actually gated anything.
+  # actions/checkout@v4 needs node inside the job container and python images
+  # don't ship it, so clone manually (public repo, no token needed).
   python-lint:
     needs: skip-ci-check
     if: needs.skip-ci-check.outputs.should-skip != '1'
@@ -80,11 +82,14 @@ jobs:
     container:
       image: python:3.12-bookworm
     steps:
-      - uses: actions/checkout@v4
-      - name: Install ruff
-        run: pip install "ruff==0.16.0"
-      - name: Ruff check
-        run: ruff check backend
+      - name: Checkout and ruff check
+        run: |
+          BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}"
+          git clone --branch "$BRANCH" --depth 1 \
+            "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" /tmp/src
+          pip install "ruff==0.16.0"
+          cd /tmp/src
+          ruff check backend
 
   # Vitest unit tests (viewer-frontend) — landed in PR #63, wired here.
   viewer-unit: