ci: name bash as the shell, dash has no pipefail

The container job picked `sh -e {0}`, and sh on eclipse-temurin:jammy is
dash. Every `set -euo pipefail` step failed on line 2 with "Illegal option
-o pipefail" before running a command, so unit-tests and vectors-head went
red without compiling anything.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -17,6 +17,13 @@ env:
   IMAGE: git.extant2000.com/extant2000/flamenet-android-ci:jdk21.0.5-api35-r1
   GITEA_BASE: https://git.extant2000.com/extant2000
 
+# Inside a container job the runner picks `sh -e {0}`, which is dash on this
+# image, and dash has no `pipefail`. Every `set -euo pipefail` step died on
+# line 2 before it ran anything. Named here once rather than per step.
+defaults:
+  run:
+    shell: bash
+
 jobs:
   # The repository is public, so this sweep is the last thing between a pasted
   # key and the internet. It was red for nine days in 2026-09 because nobody