ci: fix duplicate run: key in build.yml wipe-secrets step

PR #79 (6ee8f2748, mesa-panvk-bifrost-video) added a second `run:`
mapping key on the next line of the same step:

    - name: wipe secrets
      if: always()
      run: rm -f /root/repo_pass /root/.ssh/id_ed25519
      run: rm -f /root/.ssh/id_ed25519_hertz    ← duplicate `run:` key

YAML doesn't allow two mappings with the same key in one node, so
Gitea's workflow parser rejected the entire file:

  actions/workflows.go:124:DetectWorkflows() [W]
    ignore invalid workflow "build.yml": yaml: unmarshal errors:
      line 1423: mapping key "run" already defined at line 1422

Result: every push to main since 6ee8f2748 (2026-05-21 23:14 CEST)
silently failed to enqueue ANY action run.  PR #80's "re-trigger by
README touch" had no chance — workflow file was invalid before #80
even existed.  Runs #161-163 do not exist; #160 (pre-#79) is the
last successful enqueue.

Fix: merge the two single-line `run:` invocations into one literal
block.  Functionally identical, YAML-valid.

Post-merge: workflow file becomes valid again, new push to main
triggers a fresh build run covering the backlog (#79's
mesa-panvk-bifrost-video build that #80 wanted re-triggered).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -1419,8 +1419,9 @@ jobs:
 
       - name: wipe secrets
         if: always()
-        run: rm -f /root/repo_pass /root/.ssh/id_ed25519
-        run: rm -f /root/.ssh/id_ed25519_hertz
+        run: |
+          rm -f /root/repo_pass /root/.ssh/id_ed25519
+          rm -f /root/.ssh/id_ed25519_hertz
 
   # -------------------------------------------------------------------------
   # mesa-panvk-bifrost-video (aarch64 only) — sibling adding VK_KHR_video_decode_h264