use patched ocijail for mlock

Author: ahze

.github/workflows/build.yml

@@ -106,6 +106,10 @@ jobs:
             # Test deps (cit)
             pkg install -y py311-selenium py311-scikit-image chromium
 
+            # Install patched ocijail for .NET apps (mlock support)
+            fetch -qo /tmp/ocijail.pkg https://github.com/daemonless/freebsd-ports/releases/download/v0.4.0-patched/ocijail-0.4.0_2.pkg
+            pkg install -fy /tmp/ocijail.pkg
+
             rm -rf /var/db/containers /var/lib/containers 2>/dev/null || true
             kldload pf
             sysctl net.inet.ip.forwarding=1