the podman repair replaces the apt pasta too and probes the rootless half

Author: Letdown2491

.github/actions/install-boot/action.yml

@@ -90,26 +90,35 @@ runs:
         HOMEBREW_NO_AUTO_UPDATE=1 brew install podman
         sudo ln -sf "$(command -v podman)" /usr/local/bin/podman
         echo "podman version now: $(podman --version)"
-        # The poured podman brings a matching crun, but linking podman
-        # alone left the repair running the apt crun: rootful podman
-        # resolves its runtime from a fixed path list that reads
-        # /usr/bin/crun before anywhere brew pours, and sudo's PATH never
-        # reaches the brew prefix either. The apt crun 0.17 rejects the
-        # OCI spec the new podman writes ("crun: unknown version
-        # specified", measured 2026-09-04), and the install would hit the
-        # same wall at its first rootful run. So the repair replaces the
-        # old crun where the list looks first, like the podman above.
-        [ -x "$(command -v crun)" ] \
-          || { echo "brew poured podman but no crun came with it" >&2; exit 1; }
-        sudo ln -sf "$(command -v crun)" /usr/bin/crun
-        echo "crun now at: $(readlink /usr/bin/crun)"
+        # The poured podman brings matching helpers, but linking podman
+        # alone left the repair running the apt ones: podman resolves
+        # crun and pasta from fixed path lists that read /usr/bin before
+        # anywhere brew pours, and sudo's PATH never reaches the brew
+        # prefix either. The apt crun 0.17 rejected the OCI spec the new
+        # podman writes ("crun: unknown version specified") and the apt
+        # pasta rejected its --map-guest-addr ("pasta failed with exit
+        # code 1"), both measured 2026-09-04, each wall costing a run.
+        # So the repair replaces the old helpers where the lists look
+        # first, like the podman above. conmon is shadowed the same way
+        # but the apt one starts containers fine, so it is left alone.
+        for helper in crun pasta; do
+          [ -x "$(command -v "$helper")" ] \
+            || { echo "brew poured podman but no $helper came with it" >&2; exit 1; }
+          sudo ln -sf "$(command -v "$helper")" "/usr/bin/$helper"
+          echo "$helper now at: $(readlink "/usr/bin/$helper")"
+        done
         # A new podman that cannot run as root would fail the install
         # twenty minutes in at the same COPY. Running a container as root
         # here costs seconds, exercises the store, the runtime and the
         # mount the build needs, and would name the real problem. Network
         # is left out on purpose: the install's build has no RUN step,
         # and the runner's own network stack is already known noise.
         sudo "$(command -v podman)" run --rm --network none quay.io/podman/hello >/dev/null
+        # The image build this prelude feeds runs podman as the runner
+        # user, where the default network is pasta and a shadowed pasta
+        # dies at the first run whatever the crun does. A rootless run
+        # here exercises that half for the same seconds.
+        "$(command -v podman)" run --rm --network pasta quay.io/podman/hello >/dev/null
 
     - uses: ./.github/actions/kvm
       with: