Revert CI to host Docker socket, remove buildkitd

BuildKit rootless failed on k3s (mount propagation), privileged mode
fixed that but buildkitd gRPC is incompatible with the Docker REST API
that forgejo-runner needs to manage job containers. Net security change
vs. the original socket approach was zero (privileged ≈ socket access).

Remove buildkitd.yaml entirely. Restore docker-sock hostPath mount on
both runners. Builds work again.

servers/legion/apps/gitea-runner.yaml

@@ -1,7 +1,6 @@
 ---
 # Gitea CI runner — general-purpose (legion)
-# Docker socket REMOVED. Builds go through buildkitd TCP endpoint.
-# Set DOCKER_HOST=tcp://buildkitd.ci.svc.cluster.local:1234 in build steps.
+# Uses host Docker socket for container management and docker build/push.
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -19,7 +18,7 @@ spec:
       labels:
         app: gitea-runner
       annotations:
-        config-version: "2026-04-25-buildkit-no-sock"
+        config-version: "2026-04-26-docker-sock"
     spec:
       securityContext:
         runAsNonRoot: false  # act_runner needs root for container management
@@ -42,7 +41,7 @@ spec:
                 timeout: 3h
               container:
                 network: host
-                docker_host: "tcp://buildkitd.ci.svc.cluster.local:1234"
+                docker_host: "unix:///var/run/docker.sock"
                 force_pull: false
                 valid_volumes: []
                 default_image: "registry.neuralplatform.ai/ci-base:latest"
@@ -60,16 +59,14 @@ spec:
           image: registry.neuralplatform.ai/ci-base:latest
           workingDir: /data
           command: ["act_runner", "daemon", "--config", "/data/config.yaml"]
-          env:
-            - name: DOCKER_HOST
-              value: "tcp://buildkitd.ci.svc.cluster.local:1234"
           envFrom:
             - secretRef:
                 name: gitea-runner-secret
           volumeMounts:
             - name: data
               mountPath: /data
-          # docker-sock volume intentionally removed — use buildkitd TCP instead
+            - name: docker-sock
+              mountPath: /var/run/docker.sock
           resources:
             requests:
               memory: 512Mi
@@ -80,7 +77,10 @@ spec:
       volumes:
         - name: data
           emptyDir: {}
-        # docker-sock hostPath intentionally removed
+        - name: docker-sock
+          hostPath:
+            path: /var/run/docker.sock
+            type: Socket
 ---
 # Neuron Technologies CI runner
 apiVersion: apps/v1
@@ -100,8 +100,10 @@ spec:
       labels:
         app: neuron-technologies-runner
       annotations:
-        config-version: "2026-04-25-buildkit-no-sock"
+        config-version: "2026-04-26-docker-sock"
     spec:
+      securityContext:
+        runAsNonRoot: false
       initContainers:
         - name: register
           image: registry.neuralplatform.ai/ci-base:latest
@@ -121,7 +123,7 @@ spec:
                 timeout: 3h
               container:
                 network: host
-                docker_host: "tcp://buildkitd.ci.svc.cluster.local:1234"
+                docker_host: "unix:///var/run/docker.sock"
                 force_pull: false
                 valid_volumes: []
                 default_image: "registry.neuralplatform.ai/ci-base:latest"
@@ -139,15 +141,14 @@ spec:
           image: registry.neuralplatform.ai/ci-base:latest
           workingDir: /data
           command: ["act_runner", "daemon", "--config", "/data/config.yaml"]
-          env:
-            - name: DOCKER_HOST
-              value: "tcp://buildkitd.ci.svc.cluster.local:1234"
           envFrom:
             - secretRef:
                 name: neuron-technologies-runner-secret
           volumeMounts:
             - name: data
               mountPath: /data
+            - name: docker-sock
+              mountPath: /var/run/docker.sock
           resources:
             requests:
               memory: 512Mi
@@ -158,3 +159,7 @@ spec:
       volumes:
         - name: data
           emptyDir: {}
+        - name: docker-sock
+          hostPath:
+            path: /var/run/docker.sock
+            type: Socket

servers/legion/k8s/gitea-runner/buildkitd.yaml

@@ -1,68 +0,0 @@
----
-# BuildKit daemon — privileged image builder for CI runners.
-# Runs as root with privileged=true in the isolated ci namespace.
-# Rootless mode (moby/buildkit:*-rootless) fails on k3s/containerd because
-# rootlesskit cannot share mount propagation on the container root fs.
-#
-# Runners connect via TCP: DOCKER_HOST=tcp://buildkitd.ci.svc.cluster.local:1234
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: buildkitd
-  namespace: ci
-  labels:
-    app: buildkitd
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: buildkitd
-  template:
-    metadata:
-      labels:
-        app: buildkitd
-    spec:
-      containers:
-        - name: buildkitd
-          image: moby/buildkit:v0.19.0
-          args:
-            - --addr
-            - tcp://0.0.0.0:1234
-            - --addr
-            - unix:///run/buildkit/buildkitd.sock
-          ports:
-            - name: tcp
-              containerPort: 1234
-          securityContext:
-            privileged: true
-          readinessProbe:
-            tcpSocket:
-              port: 1234           # k3s/containerd can't exec into privileged containers
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          resources:
-            requests:
-              cpu: 200m
-              memory: 256Mi
-            limits:
-              cpu: "4"
-              memory: 4Gi
-          volumeMounts:
-            - name: buildkit-storage
-              mountPath: /var/lib/buildkit
-      volumes:
-        - name: buildkit-storage
-          emptyDir: {}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: buildkitd
-  namespace: ci
-spec:
-  selector:
-    app: buildkitd
-  ports:
-    - name: tcp
-      port: 1234
-      targetPort: 1234