ci: drop GIT_SSL_NO_VERIFY now that runner is host-mode

The act_runner now executes jobs natively on the host (no per-job
container), so actions/checkout uses the host's system CA store,
which already trusts the host-Caddy root CA. The workaround that
disabled TLS verification for `git fetch` is no longer needed and
just hides legitimate cert issues if they ever appear.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/prod-build.yaml

@@ -21,12 +21,6 @@ on:
       - '.gitea/workflows/prod-build.yaml'
       - '!**/*.md'
 
-env:
-  # See go-unit.yaml for the rationale; this disables TLS verify for
-  # actions/checkout against the LAN Gitea host signed by host-Caddy's
-  # internal CA.
-  GIT_SSL_NO_VERIFY: "true"
-
 jobs:
   build:
     runs-on: ubuntu-latest