fix: make ci green on a fresh runner

Two issues surfaced by the first end-to-end ui-test.yaml run on a
clean Linux runner that don't reproduce locally:

- pkg/geoip tests load fixtures from the pkg/geoip/test-data git
  submodule (MaxMind-DB). actions/checkout@v4 does not fetch
  submodules by default, so the fixture path is missing on the
  runner. Both ui-test and ui-release workflows now check out with
  submodules: recursive.

- pkg/util/TestWritable asserts that /usr/lib is not writable, which
  holds for unprivileged users but fails inside the catthehacker
  workflow container that runs as root. Skip that branch when
  os.Geteuid() == 0; the root-only "the writable dir is writable"
  branch still runs.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/ui-release.yaml

@@ -21,6 +21,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          submodules: recursive
 
       - name: Set up Go
         uses: actions/setup-go@v5

.gitea/workflows/ui-test.yaml

@@ -39,6 +39,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          submodules: recursive
 
       - name: Set up Go
         uses: actions/setup-go@v5

pkg/util/fs_unix_test.go

@@ -4,6 +4,7 @@ package util_test
 
 import (
 	"galaxy/util"
+	"os"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -16,6 +17,9 @@ func TestWritable(t *testing.T) {
 	assert.NoError(t, err, "directory writable check")
 	assert.True(t, ok, "directory should be writable")
 
+	if os.Geteuid() == 0 {
+		t.Skip("/usr/lib writability check is meaningful only for unprivileged users; root inside containers can write everywhere")
+	}
 	ok, err = util.Writable(nonWritableDir)
 	assert.NoError(t, err, "system directory writable check")
 	assert.False(t, ok, "system directory should not be writable")