ci(flatpak): drop the use-vc TCP-DNS hack — the runner-side cache made it the failure

Every flatpak Tooling failure on 2026-07-22 (4 runs, incl. two AFTER the
runner fleet got its local dnsmasq cache) died in flatpak remote-add with an
instant 'Could not resolve hostname' ×10 while dnf in the SAME container
resolved fine. The one thing only this leg does is force glibc onto TCP DNS
(use-vc) — a 2026-07-11 mitigation for the embedded resolver dropping UDP
under fleet load. With job containers now resolving against the on-box
dnsmasq cache (daemon.json dns → docker0), UDP is reliable again and the TCP
path through the same chain is the flaky one under concurrency. Remove the
hack; keep the nss-resolve drop and retry.sh as the backstop.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/flatpak.yml

@@ -73,33 +73,20 @@ jobs:
       # sufficient — the Tooling step's dnf install pulls a systemd package upgrade whose RPM
       # trigger re-runs authselect and regenerates this file, undoing the fix. It's reapplied
       # there, right before the first `flatpak` network call.
-      - name: Fix container DNS (drop nss-resolve, resolve over TCP)
+      - name: Fix container DNS (drop nss-resolve)
         run: |
           sed -i 's/resolve \[!UNAVAIL=return\] //' /etc/nsswitch.conf
-          # Resolve over TCP instead of UDP. The documented root cause of the flathub
+          # History: this step used to ALSO force glibc onto TCP DNS (`options use-vc`) because
-          # bootstrap failures (investigated 2026-07-11, see the Tooling step) is this box's
+          # the runner fleet's Docker embedded resolver dropped UDP lookups under parallel-job
-          # Docker embedded resolver at 127.0.0.11 DROPPING UDP lookups while the shared
+          # load (investigated 2026-07-11; v0.15.0/v0.16.0 each burned retry.sh's whole budget).
-          # runner fleet is saturated — a datagram nobody retransmits, so the lookup just
+          # That root cause is now fixed at the infra level (2026-07-22): the runner host runs a
-          # times out. The answer then was to widen retry.sh's budget to 10 attempts (~9 min),
+          # local dnsmasq cache on the docker bridge and daemon.json points every job container
-          # which is enough to outlast a main push's ~8-workflow fan-out but NOT a TAG push's
+          # at it, so lookups terminate on-box instead of crossing the saturated uplink — the
-          # 13: v0.15.0 (twice) and v0.16.0 each burned all 10 attempts and failed the job,
+          # UDP path is reliable again. The TCP path through the same chain proved FLAKY under
-          # each needing a manual re-run.
+          # fleet concurrency (flatpak remote-add failed 10/10 with instant NXDOMAIN while dnf
-          #
+          # in the same container resolved fine), so `use-vc` flipped from mitigation to sole
-          # `use-vc` makes glibc use TCP, where the kernel retransmits and the query cannot be
+          # cause of this leg's failures — removed. retry.sh (10×) stays as the backstop for
-          # silently lost under load. Same resolver, same search path — only the transport
+          # genuine upstream blips.
-          # changes, so internal names (git.unom.io) resolve exactly as before; deliberately
-          # NO extra nameservers, which would risk answering an internal name from a public
-          # resolver. Docker's embedded DNS serves TCP on 127.0.0.11:53 as well as UDP.
-          # retry.sh stays as the backstop for genuine upstream blips.
-          #
-          # Non-fatal: Docker bind-mounts /etc/resolv.conf and can present it read-only, and a
-          # DNS tuning that cannot be applied must not be what fails the release build — that
-          # would trade an occasional re-run for a hard stop. Falling back to UDP just restores
-          # today's behaviour, which retry.sh already covers.
-          if ! grep -q '^options .*use-vc' /etc/resolv.conf 2>/dev/null; then
-            echo 'options use-vc timeout:3 attempts:3' >> /etc/resolv.conf \
-              || echo "::warning::could not set use-vc (read-only resolv.conf?); staying on UDP"
-          fi
           cat /etc/resolv.conf || true
 
       # fedora:43 has no node, but actions/checkout (a JS action) needs it. A plain `run:` step