fix(ci): post-runner-image cleanup

Three follow-up fixes uncovered by the first end-to-end CI run on the
self-hosted act_runner image:

- Replace `nrwl/nx-set-shas@v4` with a manual shell step. The action
  queries the GitHub API to discover the last successful workflow run
  and returns 404 on Gitea. The replacement derives NX_BASE/NX_HEAD
  from local git history (merge-base with the target branch on
  pull_request, HEAD~1 on push to main).
- Pin the `perf` job to `catthehacker/ubuntu:full-22.04` so Lighthouse
  CI finds a real Chrome. The default act image (act-22.04) is the
  minimal variant and ships without browsers.
- Declare `pnpm.onlyBuiltDependencies` to silence the "Ignored build
  scripts" warning and approve only the packages whose post-install
  hooks we actually rely on (Nx, Prisma, esbuild, swc, native
  watchers/resolvers).

.gitea/workflows/ci.yml

@@ -18,7 +18,22 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: nrwl/nx-set-shas@v4
+      # Derive NX_BASE / NX_HEAD for `nx affected`. Replaces
+      # nrwl/nx-set-shas@v4, which is GitHub-only (it queries the GitHub
+      # API to find the last successful workflow run, returning 404 on
+      # Gitea). HEAD~1 is a reasonable approximation for push events on
+      # a squash-merge trunk; pull_request uses the merge-base with the
+      # target branch.
+      - name: Derive Nx affected base and head
+        shell: bash
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            git fetch origin "${{ github.base_ref }}" --depth=0
+            echo "NX_BASE=$(git merge-base HEAD origin/${{ github.base_ref }})" >> "$GITHUB_ENV"
+          else
+            echo "NX_BASE=HEAD~1" >> "$GITHUB_ENV"
+          fi
+          echo "NX_HEAD=HEAD" >> "$GITHUB_ENV"
       - uses: pnpm/action-setup@v3
       - uses: actions/setup-node@v4
         with:
@@ -70,6 +85,12 @@ jobs:
 
   perf:
     runs-on: [self-hosted, on-prem]
+    # Lighthouse CI drives a real Chrome instance; the default act runner
+    # image (catthehacker/ubuntu:act-22.04) ships without one. The :full
+    # variant adds Chrome, Firefox, and the GUI-test toolchain — pinned
+    # to the same Ubuntu 22.04 base as the default labels for parity.
+    container:
+      image: catthehacker/ubuntu:full-22.04
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v3