build-iso: extract the ISO with docker cp, not a bind mount

.gitea/workflows/build-iso.yml

@@ -32,17 +32,26 @@ jobs:
           set -eu
           command -v docker >/dev/null || apk add --no-cache docker-cli
           OUT="$(mktemp -d)"
+          NAME="iso-build-${GITHUB_RUN_NUMBER}"
+          docker rm -f "$NAME" >/dev/null 2>&1 || true
+          trap 'docker rm -f "$NAME" >/dev/null 2>&1 || true' EXIT
+
           # Dated tag, never :latest — a cached mutable tag rots until its glibc is too
           # old for the tooling (that is what broke every build from 2026-07-13). Bump
           # the date when the monthly build wants a fresher base.
-          docker run --rm --privileged -v "$OUT":/out \
+          docker run --privileged --name "$NAME" \
             archlinux/archlinux:base-20260802.0.567126 bash -euc "
               pacman -Sy --noconfirm --needed archiso git jq >/dev/null
               git clone --quiet '${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git' /src
               cd /src && git checkout --quiet '${GITHUB_SHA}'
               cd /src/iso && bash build.sh
-              cp out/*.iso /out/
             "
+
+          # docker cp, not a bind mount: this daemon does not share a filesystem with the
+          # job (job containers run on a separate docker-in-docker daemon), so a bind of a
+          # local path silently resolves on the DAEMON's side and comes back empty — the
+          # ISO built fine and then vanished on the way out.
+          docker cp "$NAME:/src/iso/out/." "$OUT/"
           ls -lh "$OUT"/*.iso
           echo "ISO_DIR=$OUT" >> "$GITHUB_ENV"