fix: runner uses unix socket instead of TLS TCP for dind

Job containers spawned by the runner run inside dind. With TCP+TLS
(tcp://localhost:2376), localhost inside those containers doesn't
reach the dind sidecar. Unix socket at /run/docker.sock works because
both runner and dind share the /run emptyDir.

Also disables DOCKER_TLS_CERTDIR so dind creates the socket instead
of only listening on TLS TCP.

k8s/infra/forgejo-runner/templates/deployment.yaml

@@ -64,11 +64,7 @@ spec:
           workingDir: /data
           env:
             - name: DOCKER_HOST
-              value: tcp://localhost:2376
-            - name: DOCKER_TLS_VERIFY
-              value: "1"
-            - name: DOCKER_CERT_PATH
-              value: /docker-certs/client
+              value: unix:///run/docker.sock
           volumeMounts:
             - name: runner-data
               mountPath: /data
@@ -91,7 +87,7 @@ spec:
             privileged: true    # required for DinD; cicd namespace is labelled privileged
           env:
             - name: DOCKER_TLS_CERTDIR
-              value: /docker-certs
+              value: ""
           volumeMounts:
             - name: docker-certs
               mountPath: /docker-certs