docs(gitea-runner): record measured job capabilities, incl. root-equivalent docker access

Answering a CI-posture question from vastblue-dev meant measuring three
things rather than recalling them. Two came back the opposite of the way
the config reads:

- `container.valid_volumes: []` does NOT keep the docker daemon out of
  jobs. act_runner mounts /var/run/docker.sock on its own, so every job
  on the shared runner is uid 0 with `docker ps` over all 49 containers
  on ana-docker — gitea, synapse, phasefinal-web, adguardhome included.
  It is also load-bearing: four repos drive buildx through it, so the
  fix is isolation onto a dedicated runner, not tightening this one.
- A full-URL `uses: https://gitea.phasefinal.com/actions/checkout@v4`
  resolves from the local mirrors today. That is github-independence per
  workflow without the DEFAULT_ACTIONS_URL flip that has been parked on
  act_runner's action-fetch auth since 2026-08-05.

Also recorded: `services:` containers work (Postgres 16 on the service
name), job images need a node binary for JS actions, and `/actions/runs`
lists runs that `/actions/tasks` reports as empty on gitea 1.26.1.

Measured on a throwaway repo under the claude-bot account, since deleted.
config.yaml change is comment-only and deliberately not deployed — it
would bounce the runner for no runtime effect.

stacks/gitea-runner/README.md

@@ -35,6 +35,40 @@ invocation — not a copy-pasted playbook.
 
 Until one of those bites, one runner is enough.
 
+## What a job on this runner can actually do
+
+Measured 2026-09-02 on `pfi-fleet` (throwaway repo, three jobs, since deleted).
+Recorded because two of these are commonly assumed the other way.
+
+| capability | result |
+|---|---|
+| `services:` containers | **yes** — Postgres 16 answered on the service name as hostname after ~6 s; wait on `pg_isready`, not on ordering |
+| host docker daemon | **yes, root-equivalent** — `/var/run/docker.sock` is in every job container, `docker ps` showed all 49 host containers, `docker compose v2.33.0` on PATH |
+| `uses:` from the local mirrors | **yes** — `uses: https://gitea.phasefinal.com/actions/checkout@v4` resolves and runs, with no `DEFAULT_ACTIONS_URL` change |
+
+⚠ **`container.valid_volumes: []` does not keep docker out of jobs.** act_runner
+mounts the daemon socket itself, independently of that list, so a tight-looking
+`valid_volumes` is not containment. Any repo the runner serves — it is registered
+instance-wide — can control everything on ana-docker, gitea included. Four repos
+(`vh/Worldtree`, `vh/soong-lab`, `vh/skaldsong`, `vh/wt-matrix-bridge`) drive
+buildx through it, so it is load-bearing and closing it would break their CI.
+**Isolate sensitive builds onto a dedicated runner rather than tightening this one.**
+
+⚠ **Job images need a node binary.** JS actions execute as `node /var/run/act/...`,
+so `python:3-slim` fails on the first `uses:`. Use `node:20-bookworm`, or
+`docker:cli` plus `apk add --no-cache git nodejs` when the job also builds images.
+
+**Full-URL `uses:` is the un-parked half of the github-independence work.** The
+global `DEFAULT_ACTIONS_URL=self` flip is still blocked on act_runner's
+action-fetch auth, but a per-workflow full-URL ref needs neither the flip nor the
+auth path. Mirrors live under the `actions` and `astral-sh` orgs, all public:
+checkout, cache, upload-artifact, download-artifact, setup-node, setup-python,
+setup-uv.
+
+**Polling a run from the API:** use `/actions/runs`, not `/actions/tasks` — on
+gitea 1.26.1 `tasks` returned an empty `workflow_runs` for a run that `runs` listed
+and executed.
+
 ## Prereqs
 
 Before running the deploy playbook:

stacks/gitea-runner/conf/config.yaml

@@ -46,7 +46,19 @@ container:
   # /data volume so workspaces persist briefly between steps.
   workdir_parent: /data/workspace
 
-  # Volumes the runner allows job containers to bind-mount. Keep tight.
+  # Volumes a WORKFLOW may bind-mount into its job container. Keep tight.
+  #
+  # ⚠ This does NOT keep the docker daemon out of jobs, and reading it that
+  # way is the mistake. act_runner mounts /var/run/docker.sock into every job
+  # container on its own, independently of this list. Measured 2026-09-02: a
+  # job running `docker:27-cli` is uid 0, sees all 49 containers on this host
+  # via `docker ps`, and has `docker compose v2.33.0` on PATH.
+  #
+  # So every job on this runner has root-equivalent control of ana-docker —
+  # which hosts gitea itself, synapse, phasefinal-web and adguardhome. It is
+  # also LOAD-BEARING: vh/Worldtree, vh/soong-lab, vh/skaldsong and
+  # vh/wt-matrix-bridge all drive buildx through that socket, so it cannot
+  # simply be closed. Isolate sensitive work onto its own runner instead.
   valid_volumes: []
 
   force_pull: false