ci: fix source-check workspace permissions for containers

.gitea/workflows/cicd-source-checks.yaml

@@ -158,7 +158,7 @@ jobs:
           HEAD_SHA: ${{ needs.setup.outputs.head_sha }}
         run: |
           set -e
-          umask 077
+          umask 022
           trap 'rm -f ~/.ssh/id_rsa' EXIT
 
           mkdir -p ~/.ssh
@@ -184,6 +184,9 @@ jobs:
             exit 1
           }
 
+          # Ensure containerized checks can read workspace even under rootless/remapped Docker.
+          chmod -R a+rX backend
+
       - name: Run backend format/lint/type checks
         run: |
           set -e
@@ -231,7 +234,7 @@ jobs:
           HEAD_SHA: ${{ needs.setup.outputs.head_sha }}
         run: |
           set -e
-          umask 077
+          umask 022
           trap 'rm -f ~/.ssh/id_rsa' EXIT
 
           mkdir -p ~/.ssh
@@ -257,6 +260,9 @@ jobs:
             exit 1
           }
 
+          # Ensure containerized checks can read workspace even under rootless/remapped Docker.
+          chmod -R a+rX frontend
+
       - name: Run frontend format/lint/type checks
         run: |
           set -e