feat(gitea): docker-mode env hygiene + document containerized job migration
- add-host-runner.sh docker mode now strips host-specific envs (HOME, PATH,
PNPM_HOME) that leak macOS paths into Linux containers and override workflow
env (broke $HOME-relative writes)
- GITEA_VM_SETUP.md 11.5: reference pattern + 5 gotchas for migrating a real
job (docker-lint) onto the docker runner: Actions secret (not token file),
doctor.sh token-file requirement, host-env leakage, env_file token override,
proxy bypass. Validated green on M-…-4.
77b074f3c0