feat(gitea-runner): opt-in fast runner on nh3-docker (label nh3-docker), no docker socket in jobs

Prime's CI fix A. ana-docker's runner sits on HDD mirrors with no SLOG; synced
8 KiB writes measured ~34 ms there vs ~2.7 ms on nh3-docker (same probe, one run,
n=3 each). Repos opt in with runs-on: nh3-docker; the runner carries no
pfi-fleet label. Its config is tighter because nh3-docker also runs NH3 DNS and
the post office: docker_host '-' (verified absent in the job, present on the
ana-docker baseline), capacity 1, jobs capped at 4 GiB / 6 CPUs, a network per
job. The deploy playbook takes runner_config; each runner's homepage name is
its runner name.

stacks/gitea-runner/conf/config.nh3-docker.yaml

@@ -0,0 +1,43 @@
+# act_runner config for the OPT-IN fast runner on nh3-docker (Prime's CI fix A, 2026-10-12).
+# Mounted at /data/config.yaml. Deployed by playbooks/deploy-gitea-runner.yaml with
+#   --var runner_config=stacks/gitea-runner/conf/config.nh3-docker.yaml
+#
+# Why it exists: the central runner on ana-docker sits on pfi-pve's `ospool` (HDD mirrors, no SLOG); 8 KiB fsync
+# writes measured ~145 ms there vs ~2.7 ms on nh3-docker. Jobs that fsync a lot (a Postgres service, pytest temp
+# dirs) ran past the 30 m job timeout. Repos opt in with `runs-on: nh3-docker`. The runner carries ONLY that label,
+# never `pfi-fleet`, so nothing lands here by accident.
+#
+# Why it is tighter than ana-docker's config: nh3-docker also runs NH3's DNS (adguardhome) and the althing post
+# office, on 8 vCPU / 7 GiB. So:
+#   - docker_host "-": the job containers do NOT get the host docker socket (ana-docker's runner hands every job root
+#     over its host). `services:` still work, because the runner creates them through its own socket.
+#   - capacity 1, and each job container is capped at 4 GiB / 6 CPUs, leaving room for DNS and the bus.
+#   - network "": every job gets its own throwaway network, not traefik-net.
+
+log:
+  level: info
+
+runner:
+  file: /data/.runner
+  capacity: 1
+  timeout: 30m
+  shutdown_timeout: 1m
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+
+cache:
+  enabled: true
+  dir: /data/cache
+
+container:
+  network: ""
+  privileged: false
+  options: "--memory=4g --memory-swap=4g --cpus=6"
+  workdir_parent: /data/workspace
+  valid_volumes: []
+  docker_host: "-"
+  force_pull: false
+
+host:
+  workdir_parent: /data/host-workspace