ci: switch to SDK-aware workflow with MODULE_SDK_PAT auth

The previous workflow was a copy of the pre-SDK template — it
did the own-repo checkout but had no provision for fetching
fai-module-sdk from git.flemming.ws/fai/module-sdk. After the
v0.3.0 SDK migration, every CI run failed at the cargo fetch
stage because the runner had no credential for the cross-org
private repo.

Adopt the same pattern that text-extract and llm-chat already
use: a MODULE_SDK_PAT actions secret, CARGO_NET_GIT_FETCH_WITH_CLI=true,
and a 'git config url.X.insteadOf Y' that injects the token
into any outgoing git.flemming.ws URL transparently.

Bumps the module to 0.3.2 (patch — CI infrastructure only,
behaviour unchanged).

Signed-off-by: flemming-it <sf@flemming.it>

.forgejo/workflows/ci.yml

@@ -10,16 +10,16 @@ env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
   RUST_TOOLCHAIN: "1.86"
+  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
 
 jobs:
   ci:
     name: Linux x86_64 (Forgejo)
     runs-on: ubuntu-latest
     steps:
-      # See fai/platform docs/architecture/ci.md for why we
-      # check out via the external URL instead of using
-      # actions/checkout.
-      - name: Checkout via external URL
+      # Manual external-URL checkout — see fai/platform CI for
+      # background. Lays this repo at $GITHUB_WORKSPACE.
+      - name: Checkout text-extract via external URL
         run: |
           set -eu
           mkdir -p "$GITHUB_WORKSPACE"
@@ -30,6 +30,23 @@ jobs:
           git fetch --depth=1 origin "$GITHUB_SHA"
           git checkout -q FETCH_HEAD
 
+      # The fai-module-sdk dependency is a git dep against a repo
+      # that lives in another Forgejo org. The repo-scoped
+      # GITHUB_TOKEN cannot read it, and the Forgejo instance has
+      # REQUIRE_SIGNIN_VIEW=true so anonymous read is also denied.
+      # MODULE_SDK_PAT is a stored secret with read access to
+      # fai/module-sdk; we inject it into any outgoing
+      # https://git.flemming.ws/ URL via insteadOf so cargo's git
+      # fetch (driven by CARGO_NET_GIT_FETCH_WITH_CLI) authenticates
+      # transparently.
+      - name: Configure git URL rewrite for SDK fetch
+        env:
+          SDK_PAT: ${{ secrets.MODULE_SDK_PAT }}
+        run: |
+          git config --global \
+            "url.https://x-access-token:${SDK_PAT}@git.flemming.ws/.insteadOf" \
+            "https://git.flemming.ws/"
+
       - name: Install system dependencies
         run: |
           apt-get update -qq
@@ -56,13 +73,13 @@ jobs:
         run: cargo fmt --all -- --check
 
       - name: Cargo clippy
-        run: cargo clippy --workspace --all-targets -- -D warnings
+        run: cargo clippy --all-targets -- -D warnings
 
       - name: Cargo build (host)
-        run: cargo build --workspace --all-targets
+        run: cargo build --all-targets
 
       - name: Cargo test (host)
-        run: cargo test --workspace --all-targets
+        run: cargo test --all-targets
 
       - name: Cargo build (wasm32-wasip2)
         run: cargo build --release --target wasm32-wasip2