fix: run without setup-node mirror; install PyYAML via venv

Gitea dogfood failed because actions/setup-node is not mirrored
(404 on git.potatolab.uk/actions/setup-node) and pip --user is
blocked by PEP 668. Prefer runner Node with an optional mirrored
setup-node, and install PyYAML into a workspace venv.

action.yml

@@ -48,16 +48,40 @@ outputs:
 runs:
   using: composite
   steps:
-    - name: Setup Node (stdlib only)
+    # Gitea forges often lack an actions/setup-node mirror (clone → 404).
+    # Prefer runner-provided Node; only call setup-node when the mirror exists.
+    - name: Setup Node (optional mirror)
+      id: setup_node
+      continue-on-error: true
       uses: actions/setup-node@v4
       with:
         node-version: "20"
 
+    - name: Require Node.js
+      shell: bash
+      run: |
+        if ! command -v node >/dev/null 2>&1; then
+          echo "::error::Node.js >= 18 required for Gatekeep (merge-findings.js / publish.js)."
+          echo "Mirror actions/setup-node on this forge, preinstall Node on the runner, or add setup-node before uses: ./."
+          exit 1
+        fi
+        node --version
+
+    # PEP 668 blocks pip --user on many runners; use a workspace venv instead.
     - name: Install PyYAML (providers.yaml)
       shell: bash
       run: |
-        python3 -m pip install --user pyyaml -q
-        python3 -c "import yaml; print('pyyaml ok', yaml.__version__)"
+        if python3 -c "import yaml" 2>/dev/null; then
+          python3 -c "import yaml; print('pyyaml ok', yaml.__version__)"
+          exit 0
+        fi
+        VENV="${{ github.workspace }}/.gatekeep/.venv"
+        mkdir -p "$(dirname "$VENV")"
+        python3 -m venv "$VENV"
+        "$VENV/bin/pip" install -q pyyaml
+        echo "$VENV/bin" >> "$GITHUB_PATH"
+        echo "VIRTUAL_ENV=$VENV" >> "$GITHUB_ENV"
+        "$VENV/bin/python" -c "import yaml; print('pyyaml ok', yaml.__version__)"
 
     - name: Discover entry points
       id: discover