Release builds (Pithos's Linux packages first) were made by hand on a
production server. The runner takes them over. Jobs run in a private
docker-in-docker engine rather than the host's Docker, so a workflow
cannot reach the forgejo, postgres or caddy containers; one job at a
time on this one-CPU host. scripts/runner-setup.sh registers it.
