fix(action): drop dead RUNNER_LABELS branch, fail fast on ambiguous guest-os

act_runner does not expose the job's runs-on label to the workflow: v1.0.4
provides only RUNNER_OS/ARCH/TEMP/TOOL_CACHE/DEBUG/VERSION, verified against
the binary. The `$env:RUNNER_LABELS -match 'linux'` check was therefore always
false, so guest-os: 'Auto' silently resolved to Windows and selected the
Windows template for Linux jobs. It was masked only because every caller passes
guest-os explicitly or overrides template-path.

'Auto' cannot pick a template on its own -- the VMX guestOS field is only
readable after the clone -- so it now requires template-path and snapshot-name
and errors otherwise, instead of falling back to the wrong template.

Add GITEA_CI_LINUX_SNAPSHOT_NAME so a runner instance dedicated to a Linux
variant can declare its own snapshot instead of every workflow repeating it;
the Linux snapshot was hardcoded to BaseClean-Linux.

BREAKING: a workflow using the composite with neither guest-os nor
template-path now fails instead of silently using the Windows template.

.gitea/actions/local-ci-build/action.yml

@@ -22,9 +22,18 @@
 #             submodules: 'true'
 #             # xvfb: 'true'   # Linux: run the build under a headless X server
 #
-# Runner label determines the guest OS template:
-#   windows-build  ->  WinBuild2025 (WinRM/HTTPS transport)
-#   linux-build    ->  LinuxBuild2404 (SSH transport)
+# The template comes from the `guest-os` input, NOT from the runs-on label:
+# act_runner does not expose the job's label to the action, so this action
+# cannot see which runner picked the job.
+#
+#   guest-os: 'Windows'  ->  GITEA_CI_TEMPLATE_PATH        (WinRM/HTTPS)
+#   guest-os: 'Linux'    ->  GITEA_CI_LINUX_TEMPLATE_PATH  (SSH)
+#   guest-os: 'Auto'     ->  requires template-path + snapshot-name; the guest
+#                            OS is then sniffed from the cloned VMX
+#
+# Routing a label to a different template is therefore a *runner-side* concern:
+# register a second runner instance whose envs point at that template (this is
+# how rust-build:host -> LinuxRust2404 works), or pass template-path per job.
 
 name: Local CI Build
 description: >
@@ -57,7 +66,10 @@ inputs:
   guest-os:
     description: >
       Guest OS type: Windows, Linux, or Auto.
-      Auto (default) detects the OS from the VMX guestOS field after cloning.
+      Windows/Linux select the template and snapshot from the runner env vars.
+      Auto defers OS detection to the VMX guestOS field after cloning, which
+      means it cannot pick the template itself — with Auto you must also pass
+      template-path and snapshot-name, or the action fails fast.
     required: false
     default: 'Auto'
 
@@ -300,14 +312,24 @@ runs:
             $repoCommit = '${{ github.sha }}'
         }
 
-        # Resolve guest OS: honor explicit input; for Auto, infer from RUNNER_LABELS
+        # Resolve guest OS.
+        #
+        # 'Auto' is NOT resolved here: act_runner exposes no RUNNER_LABELS
+        # variable (v1.0.4 provides only RUNNER_OS/ARCH/TEMP/TOOL_CACHE/DEBUG/
+        # VERSION), so the job's runs-on label is invisible to this action.
+        # The previous label sniff always fell through to 'Windows', which
+        # silently selected the Windows template for Linux jobs.
+        #
+        # 'Auto' is instead forwarded to the Python CLI, which reads the
+        # guestOS field from the cloned VMX — but that happens *after* the
+        # clone, so the template and snapshot must already be known. Hence:
+        # Auto requires both template-path and snapshot-name.
         $resolvedGuestOS = $env:INPUT_GUEST_OS
-        if ($resolvedGuestOS -eq 'Auto') {
-            if ($env:RUNNER_LABELS -match 'linux') {
-                $resolvedGuestOS = 'Linux'
-            } else {
-                $resolvedGuestOS = 'Windows'
-            }
+        if ($resolvedGuestOS -eq 'Auto' -and (-not $env:INPUT_TEMPLATE_PATH -or -not $env:INPUT_SNAPSHOT_NAME)) {
+            throw ("guest-os: 'Auto' cannot select a template or snapshot on its own — " +
+                   "act_runner does not expose the job's runs-on label to the action. " +
+                   "Either set guest-os to 'Windows'/'Linux' (uses the runner env defaults), " +
+                   "or pass both template-path and snapshot-name explicitly.")
         }
 
         # Select template path: explicit input overrides OS-based runner env var
@@ -320,16 +342,23 @@ runs:
             }
         }
 
-        # Select snapshot name: explicit input > OS-based default
-        # GITEA_CI_SNAPSHOT_NAME applies to Windows (template-refresh override)
+        # Select snapshot name: explicit input > OS-based default.
+        # GITEA_CI_SNAPSHOT_NAME applies to Windows (template-refresh override);
+        # GITEA_CI_LINUX_SNAPSHOT_NAME is the Linux equivalent, which lets a
+        # runner instance dedicated to a Linux variant (e.g. the rust-build
+        # runner pointing at LinuxRust2404) declare its own snapshot instead of
+        # every workflow repeating it.
         $resolvedSnapshotName = $env:INPUT_SNAPSHOT_NAME
         if (-not $resolvedSnapshotName) {
             if ($resolvedGuestOS -eq 'Linux') {
-                $resolvedSnapshotName = 'BaseClean-Linux'
+                $resolvedSnapshotName = if ($env:GITEA_CI_LINUX_SNAPSHOT_NAME) { $env:GITEA_CI_LINUX_SNAPSHOT_NAME } else { 'BaseClean-Linux' }
             } else {
                 $resolvedSnapshotName = if ($env:GITEA_CI_SNAPSHOT_NAME) { $env:GITEA_CI_SNAPSHOT_NAME } else { 'BaseClean' }
             }
         }
+        Write-Host "[local-ci-build] template: $resolvedTemplatePath"
+        Write-Host "[local-ci-build] snapshot: $resolvedSnapshotName"
+        Write-Host "[local-ci-build] guest-os: $resolvedGuestOS"
 
         # Build argument list for the Python CLI. Long-form kebab-case flags only.
         # NOTE: never put an empty string in the splatted array — PowerShell