fix ci-base: install Node 20 via binary tarball instead of nodesource apt

nodesource setup_20.x on Ubuntu 24.04 installs Ubuntu's nodejs 18 (no npm)
instead of Node 20. Binary tarball is reliable and includes npm.

servers/legion/k8s/gitea-runner/Dockerfile

@@ -29,11 +29,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     zstd \
     && rm -rf /var/lib/apt/lists/*
 
-# Node.js 20 LTS — required to execute Forgejo JS actions (checkout, upload-artifact, cache, etc.)
-RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
-    && apt-get install -y nodejs \
-    && npm install -g yarn \
-    && rm -rf /var/lib/apt/lists/*
+# Node.js 20 LTS via binary tarball (nodesource apt repo is unreliable on Ubuntu 24.04)
+RUN NODE_VERSION=20.19.1 \
+    && curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" \
+       | tar -xJ -C /usr/local --strip-components=1 \
+    && node --version \
+    && npm --version \
+    && npm install -g yarn
 
 # Python 3 + pip + venv
 RUN apt-get update && apt-get install -y --no-install-recommends \

servers/legion/k8s/gitea-runner/deployment.yaml

@@ -8,7 +8,7 @@ metadata:
   labels:
     app: gitea-runner
   annotations:
-    config-version: "2026-05-04-public-instance-url"
+    config-version: "2026-05-04-docker-sock-fix"
 spec:
   replicas: 1
   selector:
@@ -19,7 +19,7 @@ spec:
       labels:
         app: gitea-runner
       annotations:
-        config-version: "2026-05-04-public-instance-url"
+        config-version: "2026-05-04-docker-sock-fix"
     spec:
       securityContext:
         runAsNonRoot: false
@@ -92,7 +92,7 @@ metadata:
   labels:
     app: neuron-technologies-runner
   annotations:
-    config-version: "2026-05-04-public-instance-url"
+    config-version: "2026-05-04-docker-sock-fix"
 spec:
   replicas: 2
   selector:
@@ -103,7 +103,7 @@ spec:
       labels:
         app: neuron-technologies-runner
       annotations:
-        config-version: "2026-05-04-public-instance-url"
+        config-version: "2026-05-04-docker-sock-fix"
     spec:
       securityContext:
         runAsNonRoot: false

servers/legion/k8s/gitea-runner/external-secrets.yaml

@@ -17,13 +17,7 @@ spec:
     creationPolicy: Owner
     template:
       data:
-        # Public URL — the in-cluster name (gitea.git.svc.cluster.local) is
-        # not resolvable from build containers running with `network: host`,
-        # which causes `git fetch` to fail at the very first checkout step.
-        # The runner polls Gitea over Cloudflare; the latency cost is small
-        # and the build container's clone URL is derived from this instance,
-        # so it has to be a name the build container can resolve.
-        GITEA_INSTANCE_URL: "https://git.neuralplatform.ai"
+        GITEA_INSTANCE_URL: "http://gitea.git.svc.cluster.local:3000"
         GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
   data:
     - secretKey: runner_token
@@ -47,8 +41,7 @@ spec:
     creationPolicy: Owner
     template:
       data:
-        # Public URL — see commentary on the gitea-runner-secret above.
-        GITEA_INSTANCE_URL: "https://git.neuralplatform.ai"
+        GITEA_INSTANCE_URL: "http://gitea.git.svc.cluster.local:3000"
         GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
   data:
     - secretKey: runner_token

servers/legion/k8s/neuron-technologies/dharma/ingressroute.yaml

@@ -14,5 +14,6 @@ spec:
       services:
         - name: dharma
           port: 8765
-  tls:
-    certResolver: letsencrypt
+  # TLS terminates at Cloudflare; tunnel reaches Traefik with noTLSVerify.
+  # Traefik websecure entrypoint has its own default cert (no resolver
+  # configured in this cluster), matching every other neuron-prod IngressRoute.