fix(images): name the measured runner blocker; the job container gets no Docker daemon

PR #81's first images run failed in 6s: act_runner 0.2.11 forces docker_host '-' for a tcp://
DOCKER_HOST, and gitea/act drops every bind when valid_volumes is empty. Giving jobs the
privileged DinD daemon is node-root for any workflow author, so it is left to the operator;
options are in the handoff entry. The driver's failure now names the cause.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.gitea/workflows/images.yaml

@@ -41,6 +41,15 @@
 # not checked by Gitea (basic.go resolves the owner from the token), so `vars.REGISTRY_PUSH_USER`
 # is optional and only labels the login.
 #
+# ┌─ BLOCKER, MEASURED ON PR #81 (run 325): THIS RUNNER CANNOT BUILD IMAGES YET ───────────────┐
+# │ The job container gets no Docker daemon. act_runner 0.2.11 forces container.docker_host to  │
+# │ "-" whenever DOCKER_HOST is tcp:// (internal/app/cmd/daemon.go), and with valid_volumes: []  │
+# │ gitea/act strips every bind including the socket (pkg/container/docker_run.go             │
+# │ sanitizeConfig). So this job fails at its first check, loudly, until the operator chooses   │
+# │ how workflow code may reach a daemon — see decisions/2026-10-29-image-pipeline.md. It is    │
+# │ not a required check, so it does not block merges; it is red, which is the honest state.   │
+# └──────────────────────────────────────────────────────────────────────────────────────────────┘
+#
 # THE RUNNER (apps/wave-1/gitea-actions.yaml): act_runner 0.2.11, one job at a time, Docker
 # executor on a privileged `docker:27-dind` sidecar whose image store is an emptyDir on the node
 # (no sizeLimit) and whose memory limit is 2Gi — shared by the job container AND every build

.gitea/workflows/scripts/images.sh

@@ -200,8 +200,13 @@ push_one() { # <image> -> sets DIGEST[image] to the registry-returned digest
 log "image pipeline: MODE=${MODE} IMAGES=${IMAGES} HEAD=${HEAD_SHA}"
 command -v "${ENGINE}" >/dev/null || die "${ENGINE} is not on PATH in the job container"
 "${ENGINE}" info >/dev/null 2>&1 \
-  || die "the ${ENGINE} daemon is not reachable from the job container — the runner did not
-       hand it a Docker socket (act_runner container.docker_host). Nothing can be built."
+  || die "the ${ENGINE} daemon is not reachable from the job container, so nothing can be built.
+       MEASURED ON THIS RUNNER (PR #81, 2026-10-29): act_runner 0.2.11 never gives a job a
+       daemon. Its DOCKER_HOST is tcp:// (the DinD sidecar), and internal/app/cmd/daemon.go then
+       forces container.docker_host to '-' (\"can't be mounted\"); separately, with
+       valid_volumes: [] gitea/act's sanitizeConfig drops EVERY bind, the socket included.
+       Fixing it means handing workflow code the privileged DinD daemon — an operator security
+       decision, set out in decisions/2026-10-29-image-pipeline.md. Not a fault in this script."
 "${ENGINE}" version 2>/dev/null | sed -n '1,12p' || true
 "${ENGINE}" system df || true