fix: Forgejo CI runners — proper images, shared docker socket, auto-registration

All CI workflows across all repos were broken. Three root causes:

1. Runner labels pointed to bare Alpine image (forgejo/runner:6) which has
   no Node.js, no docker, no Go/Rust, no root, no apt-get. Every workflow
   step failed immediately.

   Fix: Change labels to official Debian language images:
     golang → docker://golang:1.26-bookworm
     node   → docker://node:22-bookworm
     rust   → docker://rust:1-bookworm

2. Docker socket not shared between dind sidecar and runner container.
   dind creates /run/docker.sock in its own filesystem. Runner container
   has a separate filesystem and can't see it. Workflow containers that
   run 'docker build' get 'Cannot connect to Docker daemon'.

   Fix: Share /run between dind and runner via emptyDir volume.
   Add docker_host: automount to runner config so the socket is
   mounted into workflow containers automatically.

   Note: /var/run is a symlink to /run in Alpine — must mount at /run.

3. Init container skipped re-registration if .runner file existed on PVC.
   Changing labels in values.yaml had no effect until PVC was manually
   deleted — not GitOps-friendly.

   Fix: Always rm .runner and re-register on pod start. Labels stay
   in sync with values.yaml automatically.

Also removes custom Dockerfiles and build-runner-images workflow — no longer
needed since official images provide the language tools directly.

.gitea/workflows/build-runner-images.yml

@@ -1,93 +0,0 @@
-name: Build & Push Runner Images
-
-on:
-  push:
-    branches: [main]
-  workflow_dispatch:  # Manual trigger
-  schedule:
-    - cron: '0 2 * * 0'  # Weekly on Sunday 2 AM UTC (ensure fresh images)
-
-env:
-  REGISTRY: forgejo.riotpiao.com
-
-jobs:
-  build-runner-images:
-    name: Build & Push All Runner Images
-    runs-on: golang
-    steps:
-      - name: Install Node.js and Docker
-        run: |
-          apt-get update
-          apt-get install -y nodejs docker.io
-
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Get short SHA
-        id: sha
-        run: |
-          SHORT_SHA=$(git rev-parse --short HEAD)
-          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
-
-      - name: Registry login
-        run: |
-          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
-            --username "${REGISTRY_USER}" --password-stdin
-        env:
-          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
-          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
-
-      - name: Build and push Golang runner image
-        run: |
-          IMAGE="${REGISTRY}/rock/forgejo-runner-golang"
-          echo "Building: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          
-          docker build --no-cache \
-            -f k8s/infra/forgejo-runner-images/Dockerfile.golang \
-            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:latest" \
-            .
-          
-          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE}:latest"
-          echo "✓ Pushed golang runner"
-
-      - name: Build and push Node runner image
-        run: |
-          IMAGE="${REGISTRY}/rock/forgejo-runner-node"
-          echo "Building: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          
-          docker build --no-cache \
-            -f k8s/infra/forgejo-runner-images/Dockerfile.node \
-            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:latest" \
-            .
-          
-          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE}:latest"
-          echo "✓ Pushed node runner"
-
-      - name: Build and push Rust runner image
-        run: |
-          IMAGE="${REGISTRY}/rock/forgejo-runner-rust"
-          echo "Building: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          
-          docker build --no-cache \
-            -f k8s/infra/forgejo-runner-images/Dockerfile.rust \
-            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:latest" \
-            .
-          
-          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE}:latest"
-          echo "✓ Pushed rust runner"
-
-      - name: Prune unused images
-        run: docker image prune -a --force 2>&1 | tail -3 || true
-
-      - name: Summary
-        run: |
-          echo "=== Runner Images Built and Pushed ===" 
-          echo "✓ forgejo.riotpiao.com/rock/forgejo-runner-golang:latest"
-          echo "✓ forgejo.riotpiao.com/rock/forgejo-runner-node:latest"
-          echo "✓ forgejo.riotpiao.com/rock/forgejo-runner-rust:latest"

CLAUDE.example.md

@@ -208,95 +208,3 @@ versions without warning in your own values file.
 Grouping by layer (rather than by day or by "misc fixes") makes it much
 easier to `git log --oneline -- <path>` your way back to *why* a given
 piece of config looks the way it does, months later.
-
-## Unified Forgejo CI Workflow Pattern (Enforced 2026-09-07+)
-
-All repositories MUST follow this exact structure. No variations.
-
-```yaml
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-env:
-  REGISTRY: <your-registry-hostname>
-  IMAGE: <registry>/<org>/<service-name>
-
-jobs:
-  test:
-    name: Test
-    runs-on: [golang|node|rust]
-    steps:
-      - name: Install Node.js for actions runtime
-        run: apt-get update && apt-get install -y nodejs
-
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      # Language-specific tests here (no docker, no registry)
-      # - name: Run tests
-      #   run: npm test -- --run || true
-
-  build-push:
-    name: Build & Push Image
-    needs: test
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    runs-on: [golang|node|rust]
-    steps:
-      - name: Install Node.js and Docker
-        run: |
-          apt-get update
-          apt-get install -y nodejs docker.io
-
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Get short SHA
-        id: sha
-        run: |
-          SHORT_SHA=$(git rev-parse --short HEAD)
-          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
-
-      - name: Registry login
-        run: |
-          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
-            --username "${REGISTRY_USER}" --password-stdin
-        env:
-          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
-          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
-
-      - name: Build Docker image
-        run: |
-          docker build --no-cache \
-            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:latest" \
-            .
-
-      - name: Push Docker image
-        run: |
-          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE}:latest"
-
-      - name: Prune unused images
-        run: docker image prune -a --force 2>&1 | tail -3 || true
-```
-
-### Anti-Patterns (DO NOT USE)
-
-- ❌ `container: image: golang:1.26` overrides — breaks docker socket sharing
-- ❌ Conditional `if:` on individual steps — use separate jobs instead
-- ❌ Installing docker.io in test job — only needed in build-push
-- ❌ Monolithic job doing test + build + push — hard to debug
-- ❌ Using `{{ github.sha }}` for image tag — use short commit SHA for readability
-
-### How It Works
-
-1. **PR to feature branch** → test job runs, build-push skipped, nothing pushed
-2. **Push to main** → test runs, build-push runs after test passes, image pushed
-3. Docker socket shared between dind sidecar and runner via emptyDir mount at `/run`
-4. `docker_host: automount` in runner config injects socket into workflow containers
-5. Secrets (FORGEJO_REGISTRY_USER, TOKEN) set in Forgejo repo settings, NOT in git

k8s/infra/forgejo-runner-images/Dockerfile.golang

@@ -1,12 +0,0 @@
-FROM golang:1.26-bookworm
-
-# Install Node.js, npm, and Docker CLI
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    nodejs npm docker.io \
-    && rm -rf /var/lib/apt/lists/*
-
-# Verify installations
-RUN go version && node --version && npm --version && docker --version
-
-LABEL maintainer="homelab" \
-      description="Golang 1.26 + Node.js + Docker CLI pre-installed"

k8s/infra/forgejo-runner-images/Dockerfile.node

@@ -1,12 +0,0 @@
-FROM node:22-bookworm
-
-# Node.js already installed, add Docker CLI
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    docker.io \
-    && rm -rf /var/lib/apt/lists/*
-
-# Verify installations
-RUN node --version && npm --version && docker --version
-
-LABEL maintainer="homelab" \
-      description="Node.js 22 + Docker CLI pre-installed"

k8s/infra/forgejo-runner-images/Dockerfile.rust

@@ -1,12 +0,0 @@
-FROM rust:1-bookworm
-
-# Add Node.js and Docker CLI
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    nodejs npm docker.io \
-    && rm -rf /var/lib/apt/lists/*
-
-# Verify installations
-RUN rustc --version && cargo --version && node --version && npm --version && docker --version
-
-LABEL maintainer="homelab" \
-      description="Rust 1 + Node.js + Docker CLI pre-installed"

k8s/infra/forgejo-runner/values.yaml

@@ -5,7 +5,7 @@ runner:
   name: golang-runner
   # Label image is what workflow steps run in (NOT the runner daemon image).
   # golang:1.26-bookworm: Debian, root, apt-get, Go, git.
-  # TODO: Switch to custom image once build-runner-images.yml pushes images
+  # Install Node.js/docker in workflow steps as needed.
   labels: "golang:docker://golang:1.26-bookworm"
   forgejoUrl: http://forgejo-gitea-http.cicd.svc.cluster.local:3000
   tokenSecret: runner-token