ci: make SBOM generation nested-runner safe

scripts/generate_container_sbom.sh

@@ -15,13 +15,16 @@ esac
 
 docker image inspect "$TARGET_IMAGE" >/dev/null
 mkdir -p "$ROOT/$(dirname "$OUTPUT")"
+
+# Gitea/act executes jobs inside a container while Docker commands target the
+# host daemon. Host-path binds to $ROOT therefore do not point at the checkout.
+# Stream the SPDX document over stdout instead; only the Docker socket crosses
+# the nested-runner boundary.
 docker run --rm \
   -v /var/run/docker.sock:/var/run/docker.sock \
-  -v "$ROOT:/workspace" \
-  -w /workspace \
   "$SYFT_IMAGE" \
   "$TARGET_IMAGE" \
-  -o "spdx-json=$OUTPUT"
+  -o spdx-json > "$ROOT/$OUTPUT"
 
 test -s "$ROOT/$OUTPUT"
 echo "SBOM written to $OUTPUT"