ci: use vfs to work around manifest generation in github actions environment

[Qusic]

somehow rootless overlay mount stopped working in github actions. we can force vfs to fix manifest generation.

failing log:

=== Generating manifests for docker.io
--- attr=attic target=docker.io/nixpkgs/attic:latest
Error: mount /home/runner/.local/share/containers/storage/overlay:/home/runner/.local/share/containers/storage/overlay, flags: 0x1000: permission denied

testing log after fix:

=== Generating manifests for docker.io
--- attr=attic target=docker.io/nixpkgs/attic:nixos-25.05
time="2026-05-20T20:16:15Z" level=error msg="Unable to write system event: \"write unixgram @dd53a->/run/systemd/journal/socket: sendmsg: permission denied\""
time="2026-05-20T20:16:15Z" level=warning msg="Failed to add pause process to systemd sandbox cgroup: dial unix /run/user/1001/bus: connect: permission denied"
d4ceeb5f5cc1e7dd52ed4dffafeb4cb19352e737d9a8a70148e16eedce164f91
d4ceeb5f5cc1e7dd52ed4dffafeb4cb19352e737d9a8a70148e16eedce164f91
d4ceeb5f5cc1e7dd52ed4dffafeb4cb19352e737d9a8a70148e16eedce164f91
Getting image list signatures
Copying 2 images generated from 2 images in list
Copying image sha256:b72ecd20420775a5dfd2d3fcab3e6fbefad0fe73fee4f007fd57d53194253cca (1/2)
Getting image source signatures
Copying blob sha256:31d0c150672d68c91a33121ff5c6160e51ede9871b1bb458b82a7396df6341c8
Error: copying image 1/2 from manifest list: trying to reuse blob sha256:31d0c150672d68c91a33121ff5c6160e51ede9871b1bb458b82a7396df6341c8 at destination: unable to retrieve auth token: invalid username/password: unauthorized: access token has insufficient scopes

[Qusic]

Hi @zimbatm, can you please take a look? Thanks!