ci: fix root single-user Nix install (nixbld group + SSL cert)

The single-user installer, running as root in the catthehacker container,
aborts because its bundled nix.conf sets build-users-group=nixbld and the
group doesn't exist ("the group 'nixbld' ... does not exist"). Pre-create
an empty nixbld group so config validation passes; single-user builds run
as root and never use it. Also set NIX_SSL_CERT_FILE at the job level
since we add nix to PATH without sourcing the installer profile that would
otherwise export it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/check.yml

@@ -28,8 +28,11 @@ jobs:
     runs-on: ubuntu-latest
     # Flakes for every `nix` invocation in the job (the bare `nix flake
     # check` below relies on this; the scripts pass the flag themselves).
+    # NIX_SSL_CERT_FILE because we add nix to PATH without sourcing the
+    # installer's profile (which is what normally exports it).
     env:
       NIX_CONFIG: "experimental-features = nix-command flakes"
+      NIX_SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -40,7 +43,13 @@ jobs:
         # moved to node24 ("runs.using ... got node24"). A run step has no
         # node-runtime coupling. Single-user (--no-daemon) needs no systemd,
         # which the catthehacker container doesn't run as PID 1.
+        #
+        # The installer runs as root here and validates build-users-group=
+        # nixbld from its bundled nix.conf even in single-user mode, aborting
+        # if the group is missing. Pre-create an empty nixbld group so that
+        # check passes — single-user builds run as root and never use it.
         run: |
+          groupadd -r nixbld || true
           curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
           echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH"