Take the Docker socket away from the Gitea runner

Jobs run inside the runner container (label docker:host), and with the
host's Docker socket mounted every workflow had root on the server. The
socket was only there for StarPunk's image build, which has never worked
(it logged in to gitea:3000, which the host daemon can't resolve).

Image builds now go to a rootless BuildKit container that shares only a
unix socket with the runner. Site builds keep their /sites mount.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/templates/gitea-compose.yml.j2

@@ -51,11 +51,33 @@ services:
     volumes:
       - ./runner-config.yaml:/config.yaml
       - ./data:/data
-      - /var/run/docker.sock:/var/run/docker.sock
+      # No Docker socket: jobs run inside this container (label docker:host),
+      # and the socket would give every workflow root on the server.
+      # Image builds go to the rootless BuildKit below through its socket at
+      # /run/buildkit/buildkit/buildkitd.sock.
+      - buildkit-run:/run/buildkit
       - {{ paths.stacks }}/caddy/site:/sites
+  buildkitd:
+    image: moby/buildkit:rootless
+    restart: unless-stopped
+    # Rootless BuildKit in an unprivileged container (see BuildKit's
+    # docs/rootless.md). It listens only on a unix socket shared with the runner.
+    command: ["--oci-worker-no-process-sandbox"]
+    security_opt:
+      - seccomp=unconfined
+      - apparmor=unconfined
+    extra_hosts:
+      - '{{ subdomains.git }}:{{ docker.hairpin_ip }}'
+    labels:
+      mag37.dockcheck.update: true
+    volumes:
+      - buildkit-run:/run/user/1000
+      - buildkit-cache:/home/user/.local/share/buildkit
 volumes:
   gitea:
     driver: local
+  buildkit-run:
+  buildkit-cache:
 networks:
   default:
     external: true