feat(gitea-runner): opt-in fast runner on nh3-docker (label nh3-docker), no docker socket in jobs

Prime's CI fix A. ana-docker's runner sits on HDD mirrors with no SLOG; synced
8 KiB writes measured ~34 ms there vs ~2.7 ms on nh3-docker (same probe, one run,
n=3 each). Repos opt in with runs-on: nh3-docker; the runner carries no
pfi-fleet label. Its config is tighter because nh3-docker also runs NH3 DNS and
the post office: docker_host '-' (verified absent in the job, present on the
ana-docker baseline), capacity 1, jobs capped at 4 GiB / 6 CPUs, a network per
job. The deploy playbook takes runner_config; each runner's homepage name is
its runner name.

playbooks/deploy-gitea-runner.yaml

@@ -10,11 +10,12 @@
 #   # Central runner (defaults match ana-docker)
 #   scripts/elway ana-docker --playbook playbooks/deploy-gitea-runner.yaml
 #
-#   # Site-local runner — override identity at the CLI; the .env on
-#   # the host carries the registration token + image pin.
+#   # The OPT-IN fast runner on nh3-docker (Prime's CI fix A, 2026-10-12): its own label only, and its own config.
+#   # The .env on the host carries the registration token + image pin.
 #   scripts/elway nh3-docker --playbook playbooks/deploy-gitea-runner.yaml \
 #     --var runner_name=nh3-docker-runner \
-#     --var runner_labels=pfi-fleet,nh3-docker
+#     --var runner_labels=nh3-docker:docker://node:20-bookworm-slim \
+#     --var runner_config=stacks/gitea-runner/conf/config.nh3-docker.yaml
 #
 #   scripts/elway esh-docker-vm --playbook playbooks/deploy-gitea-runner.yaml \
 #     --var runner_name=esh-runner \
@@ -40,6 +41,9 @@ vars:
   # editing files on the host by hand.
   runner_name: ""
   runner_labels: ""
+  # Which act_runner config to upload. The nh3-docker fast runner uses its own, tighter one
+  # (conf/config.nh3-docker.yaml: no docker socket in jobs, capacity 1, memory-capped jobs).
+  runner_config: stacks/gitea-runner/conf/config.yaml
 
 steps:
   # ── host-side directory prep ────────────────────────────────────────
@@ -60,7 +64,7 @@ steps:
 
   - name: Upload runner config.yaml
     upload:
-      src: stacks/gitea-runner/conf/config.yaml
+      src: "{{ runner_config }}"
       dest: "{{ data_dir }}/config.yaml"
       mode: "0644"