fix: use chroot isolation for Podman builds on unprivileged runner (#224)

Podman fails with 'cannot clone: Operation not permitted' on this runner
because it cannot create namespaces. The runner environment lacks the
capabilities for namespace-based container isolation.

Solution: Add --isolation=chroot flag to use chroot instead of namespaces.
This works in restricted environments without CAP_SYS_ADMIN or user
namespace support.

Trade-off: Chroot isolation is slower but functional on unprivileged
runners.

Reviewed-on: graham/towerops-web#224

.forgejo/workflows/production.yaml

@@ -109,8 +109,9 @@ jobs:
         run: |
           IMAGE_TAG="${{ steps.tag.outputs.tag }}"
 
-          # Build image with Podman (rootless, works on unprivileged runners)
+          # Build with chroot isolation (no namespaces required)
           podman build \
+            --isolation=chroot \
             --build-arg MIX_ENV=prod \
             --file k8s/Dockerfile \
             --tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}" \