ci: create nixbld build users for root single-user Nix install

Empty group wasn't enough — this Nix version errors with "build users
group 'nixbld' has no members". Create the nixbld group plus 10 build
users (what a multi-user install does) before running the installer.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/check.yml

@@ -44,12 +44,16 @@ jobs:
         # node-runtime coupling. Single-user (--no-daemon) needs no systemd,
         # which the catthehacker container doesn't run as PID 1.
         #
-        # The installer runs as root here and validates build-users-group=
-        # nixbld from its bundled nix.conf even in single-user mode, aborting
-        # if the group is missing. Pre-create an empty nixbld group so that
-        # check passes — single-user builds run as root and never use it.
+        # The installer runs as root here and honours build-users-group=
+        # nixbld from its bundled nix.conf, aborting unless that group exists
+        # AND has members. Create the nixbld group + build users (what a
+        # multi-user install does) before running it.
         run: |
-          groupadd -r nixbld || true
+          groupadd -r nixbld 2>/dev/null || true
+          for i in $(seq 1 10); do
+            useradd -r -g nixbld -G nixbld -d /var/empty \
+              -s /usr/sbin/nologin -c "Nix build user $i" "nixbld$i" 2>/dev/null || true
+          done
           curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
           echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH"