fix(ci): remove sudo from deploy step — not available in runner

The Gitea Actions runner pod does not have sudo. The ctr invocations
that imported and inspected images in the k8s.io containerd namespace
were prefixed with sudo, causing the Deploy API to k3s step to fail.
Removed sudo from both ctr calls; the runner already runs with the
privileges needed to access the containerd socket directly.

Co-Authored-By: Claude <noreply@anthropic.com>
AI-Generated: true

Author: rbrenner

.gitea/workflows/build.yaml

@@ -73,11 +73,11 @@ jobs:
           # Export from buildah OCI storage and import into k3s containerd
           TMPTAR=$(mktemp /tmp/openmemory-api-XXXXXX.tar)
           buildah push "$IMAGE" "oci-archive:${TMPTAR}"
-          sudo "$CTR" -n k8s.io -a "$SOCKET" images import "$TMPTAR"
+          "$CTR" -n k8s.io -a "$SOCKET" images import "$TMPTAR"
           rm -f "$TMPTAR"
           echo "IMPORTED: openmemory-api into k3s containerd (k8s.io namespace)"
           # Tag so crictl/k3s can find it by the original reference
-          DIGEST=$(sudo "$CTR" -n k8s.io -a "$SOCKET" images ls name=="$IMAGE" 2>/dev/null | awk 'NR==2{print $3}')
+          DIGEST=$("$CTR" -n k8s.io -a "$SOCKET" images ls name=="$IMAGE" 2>/dev/null | awk 'NR==2{print $3}')
           echo "Image digest in containerd: $DIGEST"
           # Rollout restart to pick up new image
           kubectl rollout restart deployment/openmemory-api -n openmemory