fix(ci): pin OpenSearch service container workdir — act_runner clobbers WORKDIR-relative ENTRYPOINT

PR #25 CI run 7745 job 'integration' failed before any test ran: 'exec:
"./opensearch-docker-entrypoint.sh": stat ...: no such file or directory'.
Root cause (confirmed against the job log's merged container.Config, and
reproduced locally with plain docker run -w): this runner's act_runner
merges the JOB's WorkingDir (/workspace/sax3l/0pt) into every SERVICE
container, clobbering the OpenSearch image's own WORKDIR
(/usr/share/opensearch) that its ENTRYPOINT ./opensearch-docker-entrypoint.sh
is relative to. ClickHouse's entrypoint is an absolute path so it started
fine under the same defect -- a green ClickHouse service is not evidence
this class of bug is absent elsewhere.

Fix: --workdir /usr/share/opensearch in the opt-ci-opensearch service's
options, restoring the image's own working directory. Verified locally:
'docker run -w /workspace/sax3l/0pt opensearchproject/opensearch:2.11.1'
reproduces the exact failure; '-w /usr/share/opensearch' fixes it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -69,7 +69,20 @@ jobs:
           # cluster_name (the OpenSearch image maps dotted env keys to
           # settings).
           cluster.name: opt_ci_${{ github.run_id }}_${{ github.run_attempt }}
+        # `--workdir` is REQUIRED (measured 2026-08-31, PR #25 CI run 7745,
+        # job "integration"): this runner's act_runner (v0.6.1) merges the
+        # JOB's WorkingDir (`/workspace/sax3l/0pt`) into every SERVICE
+        # container's config, clobbering the image's own `WORKDIR
+        # /usr/share/opensearch`. OpenSearch's ENTRYPOINT is the
+        # WORKDIR-relative `./opensearch-docker-entrypoint.sh`, so with the
+        # wrong cwd the container failed with "exec:
+        # \"./opensearch-docker-entrypoint.sh\": stat ...: no such file or
+        # directory" before it ever bound a port. ClickHouse's entrypoint is
+        # an absolute path, so it was unaffected by the same defect — do not
+        # assume a green ClickHouse service means service-container options
+        # are fine in general.
         options: >-
+          --workdir /usr/share/opensearch
           --health-cmd "curl -fsS http://localhost:9200/_cluster/health || exit 1"
           --health-interval 10s
           --health-timeout 5s