ci: fix manual checkout writing to nonexistent /tmp in kaniko image

/tmp doesn't exist in the kaniko executor:debug image (confirmed - no
standard FHS layout there at all), so the wget -O target failed with
"No such file or directory". Write into github.workspace instead, which
is known to exist since the build step already uses it.

Also adds the step-7 desktop-vs-k8s clarification from earlier.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y4YNpuC2bgT224suQLLJ7B

.forgejo/workflows/build-hello-app.yml

@@ -23,10 +23,10 @@ jobs:
       - name: Checkout (manual - no git/node in this image)
         run: |
           wget --header="Authorization: token ${{ secrets.FORGEJO_TOKEN }}" \
-            -O /tmp/source.tar.gz \
+            -O "${{ github.workspace }}/source.tar.gz" \
             "https://git.boglabob.com/${{ github.repository }}/archive/${{ github.sha }}.tar.gz"
-          tar -xzf /tmp/source.tar.gz --strip-components=1 -C "${{ github.workspace }}"
-          rm /tmp/source.tar.gz
+          tar -xzf "${{ github.workspace }}/source.tar.gz" --strip-components=1 -C "${{ github.workspace }}"
+          rm "${{ github.workspace }}/source.tar.gz"
 
       - name: Write registry auth
         run: |