fix(forgejo-runner): allow job containers to mount /docker-certs/client so docker login/build/push work

k8s/infra/forgejo-runner/templates/configmap.yaml

@@ -0,0 +1,25 @@
+# act_runner (the forgejo-runner binary) ships no config.yaml by default, so
+# `forgejo-runner daemon` runs on its hardcoded defaults -- notably
+# container.valid_volumes: [] ("if the sequence is empty, no volumes can be
+# mounted"). Confirmed via `forgejo-runner generate-config` on this exact
+# image (code.forgejo.org/forgejo/runner:6) and by running the daemon against
+# a minimal override locally: a job container that requests any bind mount
+# (e.g. the dind mTLS certs at /docker-certs/client, needed for
+# `docker login`/build/push steps) is rejected outright with no default
+# config in place.
+#
+# Scoped narrowly to exactly the certs path, read-only. Not a wildcard
+# (valid_volumes: ['**']) -- that would let any workflow in any repo this
+# runner serves bind-mount arbitrary paths off the runner pod's filesystem
+# into a job container, which is a real widening of the CI trust boundary,
+# not just a convenience.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-config
+  namespace: {{ .Release.Namespace }}
+data:
+  config.yaml: |
+    container:
+      valid_volumes:
+        - /docker-certs/client