fix(images): name the measured runner blocker; the job container gets no Docker daemon

PR #81's first images run failed in 6s: act_runner 0.2.11 forces docker_host '-' for a tcp://
DOCKER_HOST, and gitea/act drops every bind when valid_volumes is empty. Giving jobs the
privileged DinD daemon is node-root for any workflow author, so it is left to the operator;
options are in the handoff entry. The driver's failure now names the cause.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.gitea/workflows/scripts/images.sh

@@ -200,8 +200,13 @@ push_one() { # <image> -> sets DIGEST[image] to the registry-returned digest
 log "image pipeline: MODE=${MODE} IMAGES=${IMAGES} HEAD=${HEAD_SHA}"
 command -v "${ENGINE}" >/dev/null || die "${ENGINE} is not on PATH in the job container"
 "${ENGINE}" info >/dev/null 2>&1 \
-  || die "the ${ENGINE} daemon is not reachable from the job container — the runner did not
-       hand it a Docker socket (act_runner container.docker_host). Nothing can be built."
+  || die "the ${ENGINE} daemon is not reachable from the job container, so nothing can be built.
+       MEASURED ON THIS RUNNER (PR #81, 2026-10-29): act_runner 0.2.11 never gives a job a
+       daemon. Its DOCKER_HOST is tcp:// (the DinD sidecar), and internal/app/cmd/daemon.go then
+       forces container.docker_host to '-' (\"can't be mounted\"); separately, with
+       valid_volumes: [] gitea/act's sanitizeConfig drops EVERY bind, the socket included.
+       Fixing it means handing workflow code the privileged DinD daemon — an operator security
+       decision, set out in decisions/2026-10-29-image-pipeline.md. Not a fault in this script."
 "${ENGINE}" version 2>/dev/null | sed -n '1,12p' || true
 "${ENGINE}" system df || true