Traced live on the actual Pi: su - gitea-workflow left XDG_RUNTIME_DIR unset even with the user manager already running and the bus socket already there. None of su/sudo -i/sudo -u reliably go through pam_systemd on Debian - only a real SSH login or sshd itself does, which is what the deploy workflow already uses.