fix(gitea-actions): wait for dind daemon to accept connections before starting runner

The act_runner container's startup wait checked only for the dind TLS cert
FILE (/certs/client/ca.pem), but dockerd writes the certs before it begins
accepting TLS connections on :2376. A runner that proceeds on the file alone
still hard-exits with "cannot ping the docker daemon at tcp://localhost:2376",
a startup race observed crashlooping the pod during node bounces / slow
containerd starts (11 restarts in ~8 min on a fresh pod post-bounce).

Add a second bounded wait (nc -z 127.0.0.1 2376, 60s cap, mirroring the
existing cert-file loop) so the runner starts only once the daemon actually
accepts a connection. Self-healing, minimal, reversible. `nc` is present in
the gitea/act_runner:0.2.11 image (verified).

apps/wave-1/gitea-actions.yaml is a hand-authored EXTRA_UNIT raw manifest
(render.py only places it into a wave, never regenerates its bytes), so this
edit is at its source of truth; the canonical render does not emit the file
and render==golden is unaffected (gate green).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/wave-1/gitea-actions.yaml

@@ -106,8 +106,14 @@ spec:
           # Wait for the DinD sidecar to publish its TLS client certs into the shared
           # emptyDir before starting the daemon — act_runner reads /certs/client/ca.pem at
           # startup and hard-exits if it is missing (a startup race against the sidecar).
-          # Then exec the image's normal entrypoint (/sbin/tini -- /opt/act/run.sh), which
-          # registers-from-env on first boot and runs `act_runner daemon`.
+          # The cert FILE appearing is necessary but NOT sufficient: dockerd writes the
+          # certs and only THEN begins accepting TLS connections on :2376, so a runner that
+          # proceeds on the file alone still hard-exits with "cannot ping the docker daemon
+          # at tcp://localhost:2376" (observed crashlooping on node bounces / slow containerd
+          # starts). So after the certs appear, also wait until the daemon actually ACCEPTS
+          # a TCP connection on 2376 before exec'ing the image's normal entrypoint
+          # (/sbin/tini -- /opt/act/run.sh), which registers-from-env on first boot and runs
+          # `act_runner daemon`.
           command:
             - /bin/sh
             - -c
@@ -118,6 +124,12 @@ spec:
                 [ "$i" -ge 60 ] && { echo "dind certs never appeared" >&2; exit 1; }
                 echo "waiting for dind TLS certs ($i)"; sleep 1
               done
+              j=0
+              until nc -z -w1 127.0.0.1 2376; do
+                j=$((j + 1))
+                [ "$j" -ge 60 ] && { echo "dind daemon never accepted connections on 2376" >&2; exit 1; }
+                echo "waiting for dind daemon on :2376 ($j)"; sleep 1
+              done
               exec /sbin/tini -- /opt/act/run.sh
           env:
             - name: GITEA_INSTANCE_URL