ci: use rocker container with shell git checkout

Replace actions/checkout@v4 (JS action, requires Node.js) with plain git
commands using the auto-injected gitea.token for auth. This lets the workflow
run entirely inside rocker/r-ver:4.4 without any Node.js dependency.

.gitea/workflows/check.yaml

@@ -10,24 +10,26 @@ jobs:
   check:
     name: R CMD check
     runs-on: ubuntu-latest
+    container: rocker/r-ver:4.4
 
     steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up R
+      # Plain git checkout — no Node.js required, works in any container.
+      # gitea.token is automatically injected by the runner for auth.
+      - name: Check out code
+        env:
+          REPO_TOKEN: ${{ gitea.token }}
         run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y --no-install-recommends software-properties-common dirmngr
-          wget -qO- https://cloud.r-project.org/bin/linux/ubuntu/marutter_pubkey.asc \
-            | sudo tee -a /etc/apt/trusted.gpg.d/cran_ubuntu_key.asc
-          sudo add-apt-repository \
-            "deb https://cloud.r-project.org/bin/linux/ubuntu $(lsb_release -cs)-cran40/"
-          sudo apt-get update -qq
-          sudo apt-get install -y --no-install-recommends r-base r-base-dev
+          apt-get update -qq && apt-get install -y --no-install-recommends git
+          git config --global --add safe.directory "$PWD"
+          git init
+          git remote add origin \
+            "https://oauth2:${REPO_TOKEN}@gitea.civilytics.org/${{ gitea.repository }}.git"
+          git fetch --depth=1 origin "${{ gitea.sha }}"
+          git checkout FETCH_HEAD
 
       - name: Install system dependencies
         run: |
-          sudo apt-get install -y --no-install-recommends \
+          apt-get install -y --no-install-recommends \
             libcurl4-openssl-dev \
             libssl-dev \
             libxml2-dev \