fix: gitea runner docker_host path mismatch — use /var/run/docker.sock

The containerd socket is mounted from the host at /run/k3s/containerd/containerd.sock
to /var/run/docker.sock inside the container, but act_runner config was pointing to
the host path directly. Fixes CrashLoopBackOff on all runner pods.

Also codifies both deployments (will org + neuron-technologies org) as git-managed
manifests so Argo CD owns them going forward.

servers/legion/k8s/gitea-runner/deployment.yaml

@@ -0,0 +1,168 @@
+---
+# Gitea Actions runner — will org
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitea-runner
+  namespace: ci
+  labels:
+    app: gitea-runner
+  annotations:
+    config-version: "2026-05-04-docker-sock-fix"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: gitea-runner
+  template:
+    metadata:
+      labels:
+        app: gitea-runner
+      annotations:
+        config-version: "2026-05-04-docker-sock-fix"
+    spec:
+      securityContext:
+        runAsNonRoot: false
+      initContainers:
+        - name: register
+          image: registry.neuralplatform.ai/ci-base:latest
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              act_runner register \
+                --instance "$GITEA_INSTANCE_URL" \
+                --token "$GITEA_RUNNER_REGISTRATION_TOKEN" \
+                --name legion \
+                --labels "self-hosted:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-latest:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-24.04:docker://registry.neuralplatform.ai/ci-base:latest,linux,x64" \
+                --no-interactive
+              cat > /data/config.yaml << 'EOF'
+              runner:
+                capacity: 2
+                timeout: 3h
+              container:
+                network: host
+                docker_host: "unix:///var/run/docker.sock"
+                force_pull: false
+                valid_volumes: []
+                default_image: "registry.neuralplatform.ai/ci-base:latest"
+                extra_hosts:
+                  - "gitea.git.svc.cluster.local:10.43.1.53"
+              EOF
+          envFrom:
+            - secretRef:
+                name: gitea-runner-secret
+          volumeMounts:
+            - mountPath: /data
+              name: data
+          workingDir: /data
+      containers:
+        - name: runner
+          image: registry.neuralplatform.ai/ci-base:latest
+          command: ["act_runner", "daemon", "--config", "/data/config.yaml"]
+          envFrom:
+            - secretRef:
+                name: gitea-runner-secret
+          resources:
+            requests:
+              cpu: "250m"
+              memory: "512Mi"
+            limits:
+              cpu: "4"
+              memory: "4Gi"
+          volumeMounts:
+            - mountPath: /data
+              name: data
+            - mountPath: /var/run/docker.sock
+              name: docker-sock
+          workingDir: /data
+      volumes:
+        - name: data
+          emptyDir: {}
+        - name: docker-sock
+          hostPath:
+            path: /run/k3s/containerd/containerd.sock
+            type: Socket
+---
+# Gitea Actions runner — neuron-technologies org
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: neuron-technologies-runner
+  namespace: ci
+  labels:
+    app: neuron-technologies-runner
+  annotations:
+    config-version: "2026-05-04-docker-sock-fix"
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: neuron-technologies-runner
+  template:
+    metadata:
+      labels:
+        app: neuron-technologies-runner
+      annotations:
+        config-version: "2026-05-04-docker-sock-fix"
+    spec:
+      securityContext:
+        runAsNonRoot: false
+      initContainers:
+        - name: register
+          image: registry.neuralplatform.ai/ci-base:latest
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              act_runner register \
+                --instance "$GITEA_INSTANCE_URL" \
+                --token "$GITEA_RUNNER_REGISTRATION_TOKEN" \
+                --name "legion-nt-$(hostname)" \
+                --labels "self-hosted:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-latest:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-24.04:docker://registry.neuralplatform.ai/ci-base:latest,linux,x64" \
+                --no-interactive
+              cat > /data/config.yaml << 'EOF'
+              runner:
+                capacity: 2
+                timeout: 3h
+              container:
+                network: host
+                docker_host: "unix:///var/run/docker.sock"
+                force_pull: false
+                valid_volumes: []
+                default_image: "registry.neuralplatform.ai/ci-base:latest"
+                extra_hosts:
+                  - "gitea.git.svc.cluster.local:10.43.1.53"
+              EOF
+          envFrom:
+            - secretRef:
+                name: neuron-technologies-runner-secret
+          volumeMounts:
+            - mountPath: /data
+              name: data
+          workingDir: /data
+      containers:
+        - name: runner
+          image: registry.neuralplatform.ai/ci-base:latest
+          command: ["act_runner", "daemon", "--config", "/data/config.yaml"]
+          envFrom:
+            - secretRef:
+                name: neuron-technologies-runner-secret
+          resources:
+            requests:
+              cpu: "250m"
+              memory: "512Mi"
+            limits:
+              cpu: "4"
+              memory: "4Gi"
+          volumeMounts:
+            - mountPath: /data
+              name: data
+            - mountPath: /var/run/docker.sock
+              name: docker-sock
+          workingDir: /data
+      volumes:
+        - name: data
+          emptyDir: {}
+        - name: docker-sock
+          hostPath:
+            path: /run/k3s/containerd/containerd.sock
+            type: Socket