Fix CI boot check take 2: bridge IP is unreachable from the job container

Curling the sibling container's own bridge-network IP (the previous
fix) doesn't work on this runner -- docker-outside-of-docker means the
job container's network namespace can't reach another container's
bridge IP directly, so every curl attempt hung for the full ~130s TCP
SYN timeout instead of failing fast (confirmed: a run got stuck for
over 10 minutes on this). 127.0.0.1 does work here (the monorepo's own
build.yml has published a host port successfully all along), so
publish one again, but to a per-run PID-derived port instead of a
fixed one, to still avoid the original port-collision problem.

.forgejo/workflows/build.yml

@@ -28,21 +28,27 @@ jobs:
         run: docker build -t thermograph-backend:ci .
 
       - name: Boot + health check
-        # No -p host-port publish and a unique-per-run container name (this
+        # Curling the sibling container's own bridge IP does NOT work on
+        # this runner (docker-outside-of-docker: the job container's network
+        # namespace can't reach another container's bridge IP directly --
+        # every attempt hangs for the full TCP SYN timeout, ~130s, instead of
+        # failing fast) -- confirmed by a stuck run. 127.0.0.1 DOES work
+        # (proven by the monorepo's own build.yml, which has used a
+        # published host port successfully all along), so publish one, but
+        # to a per-run PID-derived port rather than a fixed one -- this
         # runner's snap-Docker install has a known AppArmor bug denying
-        # docker stop/kill -- a leftover container from a prior failed run
+        # docker stop/kill, so a leftover container from any prior failed
-        # would otherwise permanently squat a fixed host port and block
+        # run permanently squats whatever host port it was given, and a
-        # every subsequent run too). Curl the container's own bridge-network
+        # fixed port would block every subsequent run too.
-        # IP directly instead.
         run: |
           name="backend-ci-$$"
+          port=$((18000 + ($$ % 1000)))
           docker run -d --name "$name" \
             -e THERMOGRAPH_FRONTEND_BASE_INTERNAL=http://127.0.0.1:1 \
-            thermograph-backend:ci
+            -p "127.0.0.1:${port}:8137" thermograph-backend:ci
-          ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$name")
           ok=0
           for i in $(seq 1 30); do
-            if curl -fsS -o /dev/null "http://${ip}:8137/healthz"; then ok=1; break; fi
+            if curl -fsS -o /dev/null "http://127.0.0.1:${port}/healthz"; then ok=1; break; fi
             sleep 1
           done
           docker logs "$name"