feat(bootstrap): forgejo actions runner (T10)

foundation-runner (forgejo/runner:6, digest-pinned). Registration is idempotent
(ADR-007): it reuses /data/.runner if present, else mints a token via
`forgejo actions generate-runner-token` and consumes it with `forgejo-runner
register` (the token never leaves the VM). The daemon runs as uid 1000 with the
host docker group (gid 996) added for socket access — root-equivalent and
co-located, the documented day-zero compromise (PLAN-002 R5 / PLAN-001 §4a); a
fenced or separate runner VM is the steady state.

Live on cx33 Helsinki: runner declared (labels docker,dind) and polling; a
hello-world `runs-on: docker` workflow pushed to olsitec/foundation ran to
success (workflow run #1). Acceptance T10 met.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

bootstrap/components/runner.ts

@@ -0,0 +1,103 @@
+// components/runner.ts  (T10)
+//
+// foundation-runner — a Forgejo Actions runner (CONTRACT_003 §3.2). Registration
+// is idempotent (ADR-007): if the persistent /data/.runner config already exists it
+// is reused; otherwise a fresh registration token is minted with
+// `forgejo actions generate-runner-token` and consumed by `forgejo-runner register`
+// (the token never leaves the VM). The daemon then polls Forgejo for jobs.
+//
+// SECURITY (PLAN-002 R5 / PLAN-001 §4a): this runner shares the VM and is given the
+// host Docker socket so `docker`-label jobs can spawn containers — i.e. it is
+// root-equivalent on the host and is NOT fenced from the forge's trust boundary.
+// That is the documented day-zero compromise; the steady-state is a throwaway,
+// separate privileged runner VM. Do not run untrusted workflows here until fenced.
+import * as pulumi from "@pulumi/pulumi";
+import * as docker from "@pulumi/docker";
+import * as command from "@pulumi/command";
+import { DeployCtx } from "../lib/context";
+import { vmConnection } from "../lib/remote";
+import { ForgejoOutputs } from "./forgejo";
+
+export interface RunnerOutputs {
+  container: docker.Container;
+  registered: command.remote.Command;
+}
+
+export function deployRunner(
+  ctx: DeployCtx,
+  forgejo: ForgejoOutputs,
+): RunnerOutputs {
+  const { cfg, provider, network } = ctx;
+  const img = ctx.image("ACT_RUNNER");
+  const labels = cfg.runner.labels.join(",");
+
+  const image = new docker.RemoteImage(
+    "foundation-runner-image",
+    { name: img, keepLocally: true },
+    { provider },
+  );
+  const volume = new docker.Volume(
+    "foundation-runner-data",
+    { name: "foundation-runner-data" },
+    { provider, retainOnDelete: true }, // holds .runner registration secret
+  );
+
+  const register = new command.remote.Command(
+    "foundation-runner-register",
+    {
+      connection: vmConnection(ctx),
+      create: pulumi.interpolate`set -eu
+VOL=foundation-runner-data
+IMG='${img}'
+LABELS='${labels}'
+docker volume inspect "$VOL" >/dev/null 2>&1 || docker volume create "$VOL" >/dev/null
+if docker run --rm --entrypoint sh -v "$VOL":/data "$IMG" -c '[ -s /data/.runner ]'; then
+  echo "runner already registered"
+else
+  TOKEN=$(docker exec -u git foundation-forgejo forgejo actions generate-runner-token)
+  docker run --rm --network foundation-net --entrypoint /bin/forgejo-runner -v "$VOL":/data "$IMG" \\
+    register --no-interactive --instance http://foundation-forgejo:3000 --token "$TOKEN" --name foundation-runner --labels "$LABELS" >/dev/null
+  echo "runner registered"
+fi`,
+      addPreviousOutputInEnv: false,
+      triggers: [forgejo.ready.id, labels],
+    },
+    { dependsOn: [forgejo.ready] },
+  );
+
+  const container = new docker.Container(
+    "foundation-runner",
+    {
+      name: "foundation-runner",
+      image: image.imageId,
+      hostname: "foundation-runner",
+      restart: "unless-stopped",
+      entrypoints: ["/bin/forgejo-runner"],
+      command: ["daemon"],
+      // The image runs as uid 1000; add the host docker group (gid of
+      // /var/run/docker.sock) so the daemon can reach the socket without running
+      // as root. NOTE: 996 is THIS host's docker gid — re-check on DR to a new VM
+      // (`stat -c %g /var/run/docker.sock`). Socket access is root-equivalent
+      // regardless (see the security note above).
+      groupAdds: ["996"],
+      envs: ["DOCKER_HOST=unix:///var/run/docker.sock"],
+      volumes: [
+        { volumeName: volume.name, containerPath: "/data" },
+        {
+          hostPath: "/var/run/docker.sock",
+          containerPath: "/var/run/docker.sock",
+        },
+      ],
+      networksAdvanced: [{ name: network.name, aliases: ["foundation-runner"] }],
+      logDriver: "json-file",
+      logOpts: { "max-size": "10m", "max-file": "3" },
+    },
+    {
+      provider,
+      dependsOn: [network, register],
+      deleteBeforeReplace: true,
+    },
+  );
+
+  return { container, registered: register };
+}