fix(linux/build): mount /root/.docker into job containers (M1.1 iter17)

Run #4263 cleared the new builder-image job's `docker build` step
cleanly but `docker push` died with:

    no basic auth credentials

The runner host (10.0.0.51) is logged in to docker-registry.silverlabs.uk —
that's how iter1-15 builder images got pushed by hand. But the
silvermetal-builder act_runner only mounts /root/.docker into its own
container, not into the job containers it spawns. catthehacker/ubuntu:
act-latest runs as root and reads /root/.docker/config.json for auth;
without that file mounted in, docker-cli has no creds to send via the
DooD socket and the registry returns 401 Basic-realm.

Fix: extend the act_runner `container.options` to mount
/root/.docker:/root/.docker:ro into each job container, and add the same
entry to valid_volumes. Update the runner README so first-time deploys
know the host-side `docker login` is what makes the in-CI push work.

This requires a one-time runner redeploy on 10.0.0.51:

    cd /opt/silvermetal-builder-runner
    git pull
    docker compose up -d --build

After that, the builder-image job pushes cleanly and feeds its digest
to build-and-verify as designed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

linux/build/runner/README.md

@@ -34,9 +34,16 @@ GITEA_TOKEN=<admin-token> \
 cp .env.example .env
 $EDITOR .env  # paste the token
 
-# Pre-pull the builder image so the first job isn't a cold start:
+# Log in to the registry on the *host* — config.yaml mounts the resulting
+# /root/.docker/config.json into both the act_runner container and every
+# job container it spawns, so the builder-image job in build-iso-linux.yaml
+# can `docker push` without its own login step.
 docker login docker-registry.silverlabs.uk
-docker pull docker-registry.silverlabs.uk/silvermetal-builder:latest
+
+# Pre-pull the builder image so the first job isn't a cold start. (Skip
+# this on the very first deploy: the :latest tag won't exist until CI
+# runs once. After that it's pushed by the builder-image job.)
+docker pull docker-registry.silverlabs.uk/silvermetal-builder:latest || true
 
 docker compose up -d
 docker compose logs -f --tail 50   # watch for "Runner registered"

linux/build/runner/config.yaml

@@ -18,9 +18,19 @@ container:
   valid_volumes:
     - "/cache:/cache"
     - "/var/run/docker.sock:/var/run/docker.sock"
+    - "/root/.docker:/root/.docker:ro"
   options: >-
     -v /cache:/cache
     -v /var/run/docker.sock:/var/run/docker.sock
+    -v /root/.docker:/root/.docker:ro
+  # The /root/.docker mount carries the host's docker-registry.silverlabs.uk
+  # credentials into the job container, so `docker push` from the
+  # builder-image job in build-iso-linux.yaml works without an explicit
+  # `docker login` step. catthehacker/ubuntu:act-latest runs as root, so
+  # /root/.docker/config.json is what its docker-cli reads. Without this,
+  # the push fails with "no basic auth credentials" — even though docker
+  # build itself works fine over the DooD socket.
+  #
   # Cache the silvermetal-builder image locally after first pull. Bumping
   # the image digest in BUILDER_IMAGE invalidates and re-pulls automatically.
   force_pull: false