fix(ci): bootstrap Compose without a GitHub token

.gitea/workflows/ci-deploy.yml

@@ -56,14 +56,19 @@ jobs:
           node-version: '20'
 
       - name: Setup Compose for configuration checks
-        # This runner has no Docker CLI/daemon. The official action installs a
-        # standalone Compose CLI; rendering config never needs engine access.
-        uses: docker/setup-compose-action@2fe291b7677a45ee1269ec56a42604c143505e7e # v1
-        with:
-          version: v5.3.1
-          cache-binary: false
-        env:
-          GITHUB_TOKEN: '' # Public release download; never send a Gitea token to GitHub.
+        # No Docker daemon or GitHub token is required for config rendering.
+        # Pin the official Linux x86_64 release and verify before execution.
+        shell: bash
+        run: |
+          test "$(uname -m)" = x86_64
+          compose_dir="$(mktemp -d)"
+          curl --fail --silent --show-error --location --retry 3 \
+            https://github.com/docker/compose/releases/download/v5.3.1/docker-compose-linux-x86_64 \
+            -o "$compose_dir/docker-compose"
+          echo "f9ebc6ebdb19d769b793c245a736caaeb198c62587f13b25c660c13b4987f959  $compose_dir/docker-compose" | sha256sum --check --strict
+          chmod +x "$compose_dir/docker-compose"
+          "$compose_dir/docker-compose" version
+          echo "$compose_dir" >> "$GITHUB_PATH"
 
       - name: Test repository safety scripts
         # Python standard library and Compose config rendering only; no services start.