ci: install archiso via private pacman config, not /etc/pacman.conf

Writing stock core/extra over the host /etc/pacman.conf raced with the
tests workflow, which appends [cachyos]/[chaotic-aur] to the same file —
runs 132 and 133 ran concurrently on the runner, so either job could
corrupt the other's config mid-pacman.

Use 'pacman --config $(mktemp)' with stock core/extra instead: same
DNS-lookup reduction (only core/extra sync, no cachyos/chaotic), zero
writes to shared state. Verified on the runner: exit 0, only core/extra
synced, host /etc/pacman.conf mtime unchanged.

.gitea/workflows/build-iso.yaml

@@ -41,14 +41,19 @@ jobs:
       - name: Install archiso and dependencies
         run: |
           set -euo pipefail
-          # The host's /etc/pacman.conf is shared, mutable state: the tests
-          # workflow appends [cachyos] and [chaotic-aur] to it, so without this
-          # reset the build would sync two repos the host never needs (it only
-          # installs archiso/jq from extra — mkarchiso reads the *profile's*
-          # pacman.conf). Every extra repo is another DNS lookup, and the
-          # gateway intermittently drops UDP/53 (that is what failed run 131
-          # at this very step). Reset to stock core/extra.
-          cat > /etc/pacman.conf << 'STOCKCONF'
+          # Install with a *private* config instead of /etc/pacman.conf.
+          # The host config is shared mutable state: the tests workflow
+          # rewrites it and jobs overlap on this runner (runs 132 and 133
+          # ran concurrently), so writing it here could corrupt a concurrent
+          # tests run. It also carries [cachyos] and [chaotic-aur] leftovers
+          # from tests.yaml, and syncing those two repos means extra DNS
+          # lookups against a gateway that intermittently drops UDP/53 —
+          # that is what failed run 131 at this very step. The build only
+          # needs archiso/jq from extra; mkarchiso reads the *profile's*
+          # pacman.conf for everything that goes into the ISO.
+          BUILD_CONF=$(mktemp)
+          trap 'rm -f "$BUILD_CONF"' EXIT
+          cat > "$BUILD_CONF" << 'STOCKCONF'
           [options]
           DisableSandbox
           HoldPkg     = pacman glibc
@@ -64,9 +69,7 @@ jobs:
           [extra]
           Include = /etc/pacman.d/mirrorlist
           STOCKCONF
-          sed -i 's/^          //' /etc/pacman.conf
-          # Drop sync databases of the custom repos so they cannot linger
-          rm -f /var/lib/pacman/sync/cachyos* /var/lib/pacman/sync/chaotic*
+          sed -i 's/^          //' "$BUILD_CONF"
 
           # Warm the resolver cache for the mirrors we are about to query.
           # systemd-resolved serves later lookups from cache, so a gateway
@@ -86,7 +89,7 @@ jobs:
           # the whole job, so retry with backoff before giving up.
           synced=0
           for try in 1 2 3 4 5; do
-            if pacman -Syu --noconfirm --needed archiso jq; then
+            if pacman --config "$BUILD_CONF" -Syu --noconfirm --needed archiso jq; then
               synced=1
               break
             fi