No token needed: every yukart repo is public; document the caller's runs-on

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DDwfd6Ki8UfG4hK6W5YpJz

.gitea/workflows/crosscheck.yml

@@ -21,8 +21,8 @@ jobs:
     steps:
       - name: Clone every yukart repo
         env:
-          # YUKART_READ_TOKEN (org secret, read-only) reaches the private repos; without it
-          # only the public ones are checked, and the run says so.
+          # Every yukart repo is public, so no token is needed. Should one become private,
+          # an org secret YUKART_READ_TOKEN (read-only) lets this clone it again.
           TOKEN: ${{ secrets.YUKART_READ_TOKEN }}
           SERVER: ${{ gitea.server_url }}
         run: |
@@ -32,7 +32,6 @@ jobs:
           auth=(); [ -n "$TOKEN" ] && auth=(-H "Authorization: token $TOKEN")
           repos=$(curl -fsS "${auth[@]}" "$SERVER/api/v1/orgs/yukart/repos?limit=50" \
                   | python3 -c 'import json,sys; print(" ".join(r["name"] for r in json.load(sys.stdin) if not r["archived"]))')
-          [ -n "$TOKEN" ] || echo "::warning::no YUKART_READ_TOKEN: private repos are not checked"
           for r in $repos; do
             url="$scheme://${TOKEN:+crosscheck:$TOKEN@}$host/yukart/$r.git"
             git clone -q --depth 1 "$url" "ws/$r"

README.md

@@ -37,6 +37,13 @@ fails that push's run: the commit that made two repos disagree is the one marked
 A new repo is checked as soon as it exists in the org; it needs the caller only to
 trigger checks on its own pushes.
 
+- ⚠ **The caller must say `runs-on: flutter-android`.** Gitea hands a reusable-workflow
+  call to a runner chosen by the *caller's* `runs-on`; the called workflow's own is not
+  consulted for that. Without it, the instance-wide `pi5-runner` on the Gitea host takes
+  the job, and its jobs see the server as `http://gitea:3000`, which does not resolve.
+- All yukart repos are public, so cloning needs no token. A private one would need a
+  read-only org secret `YUKART_READ_TOKEN`, which the workflow already uses if set.
+
 ## Adding to it
 
 - **A false positive** is fixed in the rule, not silenced per line. Shapes that look