fix: pass DOCKER_HOST + TLS env vars to workflow containers

ROOT CAUSE: Workflow containers created by Forgejo runner don't inherit
the DOCKER_HOST/TLS env vars from the runner pod. Docker CLI defaults to
unix:///var/run/docker.sock which doesn't exist inside workflow containers.

The dind sidecar listens on tcp://localhost:2376 with TLS. With
network: host (already set), localhost inside the workflow container
reaches the dind daemon. But docker CLI needs DOCKER_HOST set explicitly.

FIX: Use runner.envs in config.yaml to pass these env vars to every
workflow container:
  DOCKER_HOST=tcp://localhost:2376
  DOCKER_TLS_VERIFY=1
  DOCKER_CERT_PATH=/docker-certs/client

The valid_volumes already allows /docker-certs/client (TLS certs).

k8s/infra/forgejo-runner/templates/configmap.yaml

@@ -32,6 +32,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
 data:
   config.yaml: |
+    runner:
+      envs:
+        DOCKER_HOST: tcp://localhost:2376
+        DOCKER_TLS_VERIFY: "1"
+        DOCKER_CERT_PATH: /docker-certs/client
     container:
       valid_volumes:
         - /docker-certs/client