fix: gitea runner Docker execution mode with catthehacker/ubuntu

Switch from :host to :docker execution so jobs run inside containers.
- Labels use docker://ghcr.io/catthehacker/ubuntu:act-22.04 (Python 3.10,
  Node 18, Docker CLI — everything CI jobs need pre-installed)
- config.yaml passes docker.sock through to job containers for build/push
- Capacity set to 2 parallel jobs

Fixes: 'Cannot find: node in PATH' — actions/checkout@v4 requires Node

servers/legion/apps/gitea-runner.yaml

@@ -26,8 +26,20 @@ spec:
                 --instance "$GITEA_INSTANCE_URL" \
                 --token "$GITEA_RUNNER_REGISTRATION_TOKEN" \
                 --name legion \
-                --labels self-hosted,linux,x64,legion \
+                --labels "self-hosted:docker://ghcr.io/catthehacker/ubuntu:act-22.04,linux:docker://ghcr.io/catthehacker/ubuntu:act-22.04,x64:docker://ghcr.io/catthehacker/ubuntu:act-22.04,legion:docker://ghcr.io/catthehacker/ubuntu:act-22.04" \
                 --no-interactive
+              # Write runner config enabling docker socket passthrough for build jobs
+              cat > /data/config.yaml << 'EOF'
+              runner:
+                capacity: 2
+                envs: {}
+                timeout: 3h
+              container:
+                network: bridge
+                options: "-v /var/run/docker.sock:/var/run/docker.sock"
+                docker_host: "unix:///var/run/docker.sock"
+                force_pull: false
+              EOF
           envFrom:
             - secretRef:
                 name: gitea-runner-secret
@@ -38,7 +50,7 @@ spec:
         - name: runner
           image: gitea/act_runner:latest
           workingDir: /data
-          command: ["act_runner", "daemon"]
+          command: ["act_runner", "daemon", "--config", "/data/config.yaml"]
           envFrom:
             - secretRef:
                 name: gitea-runner-secret