Change to a non-root account with ssh key

.gitea/workflows/gitea-main-ci.yaml

@@ -15,6 +15,8 @@
 # Required Gitea repo secrets:
 #   REGISTRY_USERNAME  - registry user for `oci_image` (oci_push=true)
 #   REGISTRY_TOKEN     - registry password/token
+#   SSH_AUTHORIZED_KEY - public key for the sudo admin user; empty => no admin
+#                        user + root left unlocked (lab). Set it to lock root.
 #   # SB_KEY, SB_CERT  - (future) Secure Boot signing key + cert for signed UKIs
 #
 # Runner: needs KVM (qemu accelerator=kvm) and the build-host tooling installed
@@ -153,4 +155,5 @@ jobs:
             -var oci_push=true \
             -var disable_dot1x=${{ env.DISABLE_DOT1X }} \
             -var nvmet_traddr="${{ env.NVMET_TRADDR }}" \
+            -var ssh_authorized_key="${{ secrets.SSH_AUTHORIZED_KEY }}" \
             .