Add root-aware privileged CI test lane

.gitea/workflows/smoke.yml

@@ -37,6 +37,43 @@ jobs:
           gcc --version | head -n 1
           pkg-config --modversion libnftables
 
+      - name: Detect runner mode
+        run: |
+          set -euo pipefail
+
+          uid="$(id -u)"
+          echo "RUNNER_UID=$uid" >> "$GITHUB_ENV"
+
+          cap_net_admin=0
+          if [ -r /proc/self/status ]; then
+            cap_eff_hex="$(awk '/^CapEff:/ { print $2 }' /proc/self/status)"
+            if [ -n "${cap_eff_hex:-}" ]; then
+              cap_eff_value=$((16#$cap_eff_hex))
+              if (( (cap_eff_value & (1 << 12)) != 0 )); then
+                cap_net_admin=1
+              fi
+            fi
+          fi
+
+          echo "RUNNER_HAS_CAP_NET_ADMIN=$cap_net_admin" >> "$GITHUB_ENV"
+
+          if [ "$uid" -eq 0 ]; then
+            echo "RUNNER_IS_ROOT=1" >> "$GITHUB_ENV"
+            echo "Root runner detected (uid 0)."
+
+            if [ "$cap_net_admin" -eq 1 ]; then
+              echo "RUN_PRIVILEGED_TESTS=1" >> "$GITHUB_ENV"
+              echo "Privileged test lane enabled."
+            else
+              echo "RUN_PRIVILEGED_TESTS=0" >> "$GITHUB_ENV"
+              echo "::warning::Root runner detected, but CAP_NET_ADMIN is unavailable. Privileged tests will be skipped."
+            fi
+          else
+            echo "RUNNER_IS_ROOT=0" >> "$GITHUB_ENV"
+            echo "RUN_PRIVILEGED_TESTS=0" >> "$GITHUB_ENV"
+            echo "Non-root runner detected; smoke-only test lane enabled."
+          fi
+
       - name: Install .NET SDK
         run: |
           set -euo pipefail
@@ -58,7 +95,13 @@ jobs:
           set -euo pipefail
           "$HOME/.dotnet/dotnet" build --no-restore
 
-      - name: Test
+      - name: Smoke tests
         run: |
           set -euo pipefail
-          "$HOME/.dotnet/dotnet" test LibNftables.slnx --no-build
+          LIBNFTABLES_RUN_PRIVILEGED_TESTS=0 "$HOME/.dotnet/dotnet" test LibNftables.slnx --no-build --filter "Category!=Privileged"
+
+      - name: Privileged tests
+        if: env.RUN_PRIVILEGED_TESTS == '1'
+        run: |
+          set -euo pipefail
+          LIBNFTABLES_RUN_PRIVILEGED_TESTS=1 "$HOME/.dotnet/dotnet" test LibNftables.slnx --no-build --filter "Category=Privileged"