ci(build): single-threaded low-priority makepkg to spare host

Parallel Rust builds have OOM-killed the Gitea host twice
(2026-04-20, 2026-04-23 run 86). Force CARGO_BUILD_JOBS=1,
MAKEFLAGS=-j1, and wrap makepkg with nice+ionice so the
act_runner can't drown the shared host.

.gitea/workflows/build-and-publish.yaml

@@ -52,7 +52,15 @@ jobs:
               # shellcheck disable=SC2086
               sudo pacman -S --needed --noconfirm $MAKEDEPS
             fi
-            makepkg -sfd --noconfirm
+
+            # Resource-constrained build. The act_runner shares CPU/RAM/I/O
+            # with the Gitea host (network-host mode). A parallel Rust build
+            # has OOM-killed the host: run 86 on 2026-04-23 stopped mid-compile
+            # with no error, taking gitea HTTPS down ~11 min. Force single-job
+            # compile and low CPU/IO priority so the host stays responsive.
+            export CARGO_BUILD_JOBS=1
+            export MAKEFLAGS="-j1"
+            nice -n 19 ionice -c 3 makepkg -sfd --noconfirm
 
             # makepkg can emit multiple artifacts per build (main + -debug
             # split package). Upload each. Arch filename convention: