Add root-aware privileged CI test lane

README.md

@@ -61,7 +61,7 @@ The test suite contains:
 
 - Managed/unit tests that do not require a native runtime
 - Native integration tests that self-gate when `libnftables` is unavailable
-- Capability-dependent tests that only run when `CAP_NET_ADMIN` is available
+- Privileged tests that only run when `LIBNFTABLES_RUN_PRIVILEGED_TESTS=1`, `uid == 0`, and `CAP_NET_ADMIN` is available
 
 ## Gitea Smoke CI
 
@@ -69,12 +69,13 @@ The repository includes a Gitea Actions smoke workflow at `.gitea/workflows/smok
 
 - Trigger: push and pull request
 - Runner label: `debian-13`
-- Job model: non-root smoke verification
+- Job model: root-aware smoke verification
 - Workflow actions:
   - bootstrap the .NET 10 SDK inside the job
   - restore
   - build
-  - run `dotnet test`
+  - always run the non-privileged smoke test lane
+  - run the privileged test lane when the runner process is `uid 0`
 
 Important runner prerequisites:
 
@@ -85,7 +86,15 @@ Important runner prerequisites:
 - `pkg-config`
 - system-installed `libnftables` development/runtime packages discoverable by `pkg-config`
 
-The job does not attempt package-manager installs or privilege escalation. It is intended to catch restore/build/test regressions, not to provide privileged nftables coverage.
+The job does not attempt package-manager installs or privilege escalation. It is intended to catch restore/build/test regressions with opportunistic privileged smoke coverage on root runners.
+
+The workflow auto-detects `id -u` at runtime:
+
+- non-root runners stay on the smoke-only path
+- root runners enable `LIBNFTABLES_RUN_PRIVILEGED_TESTS=1`
+- root runners without effective `CAP_NET_ADMIN` emit a warning and skip the privileged lane
+
+For local runs, `dotnet test` keeps privileged tests disabled by default. To opt in intentionally, set `LIBNFTABLES_RUN_PRIVILEGED_TESTS=1` in an environment where the process is running as root with `CAP_NET_ADMIN`.
 
 ## High-Level Example