Take the Docker socket away from the Gitea runner

Jobs run inside the runner container (label docker:host), and with the
host's Docker socket mounted every workflow had root on the server. The
socket was only there for StarPunk's image build, which has never worked
(it logged in to gitea:3000, which the host daemon can't resolve).

Image builds now go to a rootless BuildKit container that shares only a
unix socket with the runner. Site builds keep their /sites mount.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -82,7 +82,7 @@ subdomain.
 
 ### Docker role categories (`roles/docker/tasks/<category>/`)
 - **infrastructure/**: Caddy, Pocket ID, Dockge
-- **development/**: Gitea (+ act_runner), ByteStash
+- **development/**: Gitea (+ act_runner and rootless BuildKit; the runner has no Docker socket), ByteStash
 - **media/**: Audiobookshelf, Kavita, Karakeep (files named `hoarder`), Manyfold
 - **productivity/**: Paperless-ngx, Baikal, Syncthing, HeyForm, Dawarich, Obsidian LiveSync, Gokapi
 - **communication/**: GoToSocial, Listmonk, StarPunk (Micropub)