route runner build container clones via public URL with CF Access

The Gitea Actions runners on Legion need build containers to be able
to clone repos. They run with network: host so they can't resolve
gitea.git.svc.cluster.local — they have to use the public URL. The
public URL sits behind Cloudflare Access, which is why the previous
naive switch (#3) had to be reverted.

This change keeps the runner daemon registered against the in-cluster
URL (no CF Access on the polling loop) but rewrites
http://gitea.git.svc.cluster.local:3000/ to
https://git.neuralplatform.ai/ inside the build container, with the
CF Access service-token headers injected via git extraHeader.

The redirect script is sourced before every job step via BASH_ENV;
the CF Access credentials reach the build container through
act_runner's container.env, which we now populate from the new
gitea-runner-cf-access Vault path that PR #5's Terraform writes.

Known limitation documented in the init script: actions/checkout's
per-job auth header is keyed to the in-cluster URL and gets dropped
after the insteadOf rewrite. Public repos work; private repos that
need that token will need a follow-up.

servers/legion/k8s/gitea-runner/deployment.yaml

@@ -8,7 +8,7 @@ metadata:
   labels:
     app: gitea-runner
   annotations:
-    config-version: "2026-05-04-docker-sock-fix"
+    config-version: "2026-05-04-cf-access-public-url"
 spec:
   replicas: 1
   selector:
@@ -19,7 +19,7 @@ spec:
       labels:
         app: gitea-runner
       annotations:
-        config-version: "2026-05-04-docker-sock-fix"
+        config-version: "2026-05-04-cf-access-public-url"
     spec:
       securityContext:
         runAsNonRoot: false
@@ -35,7 +35,7 @@ spec:
                 --name legion \
                 --labels "self-hosted:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-latest:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-24.04:docker://registry.neuralplatform.ai/ci-base:latest,linux,x64" \
                 --no-interactive
-              cat > /data/config.yaml << 'EOF'
+              cat > /data/config.yaml << EOF
               runner:
                 capacity: 2
                 timeout: 3h
@@ -45,6 +45,16 @@ spec:
                 force_pull: false
                 valid_volumes: []
                 default_image: "registry.neuralplatform.ai/ci-base:latest"
+                # Build containers run with network: host. The in-cluster
+                # gitea name does not resolve there, so we redirect git
+                # operations to https://git.neuralplatform.ai using CF
+                # Access service-token headers. BASH_ENV makes bash source
+                # /usr/local/bin/git-cf-access-init.sh before every step,
+                # which sets up the redirect + headers.
+                env:
+                  CF_ACCESS_CLIENT_ID: "${CF_ACCESS_CLIENT_ID}"
+                  CF_ACCESS_CLIENT_SECRET: "${CF_ACCESS_CLIENT_SECRET}"
+                  BASH_ENV: "/usr/local/bin/git-cf-access-init.sh"
                 extra_hosts:
                   - "gitea.git.svc.cluster.local:10.43.1.53"
               EOF
@@ -92,7 +102,7 @@ metadata:
   labels:
     app: neuron-technologies-runner
   annotations:
-    config-version: "2026-05-04-docker-sock-fix"
+    config-version: "2026-05-04-cf-access-public-url"
 spec:
   replicas: 2
   selector:
@@ -103,7 +113,7 @@ spec:
       labels:
         app: neuron-technologies-runner
       annotations:
-        config-version: "2026-05-04-docker-sock-fix"
+        config-version: "2026-05-04-cf-access-public-url"
     spec:
       securityContext:
         runAsNonRoot: false
@@ -119,7 +129,7 @@ spec:
                 --name "legion-nt-$(hostname)" \
                 --labels "self-hosted:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-latest:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-24.04:docker://registry.neuralplatform.ai/ci-base:latest,linux,x64" \
                 --no-interactive
-              cat > /data/config.yaml << 'EOF'
+              cat > /data/config.yaml << EOF
               runner:
                 capacity: 2
                 timeout: 3h
@@ -129,6 +139,16 @@ spec:
                 force_pull: false
                 valid_volumes: []
                 default_image: "registry.neuralplatform.ai/ci-base:latest"
+                # Build containers run with network: host. The in-cluster
+                # gitea name does not resolve there, so we redirect git
+                # operations to https://git.neuralplatform.ai using CF
+                # Access service-token headers. BASH_ENV makes bash source
+                # /usr/local/bin/git-cf-access-init.sh before every step,
+                # which sets up the redirect + headers.
+                env:
+                  CF_ACCESS_CLIENT_ID: "${CF_ACCESS_CLIENT_ID}"
+                  CF_ACCESS_CLIENT_SECRET: "${CF_ACCESS_CLIENT_SECRET}"
+                  BASH_ENV: "/usr/local/bin/git-cf-access-init.sh"
                 extra_hosts:
                   - "gitea.git.svc.cluster.local:10.43.1.53"
               EOF