Fix job-container docker access via a shared unix socket, not TCP

The previous fix (docker_host: tcp://dind:2375) was wrong: act_runner
never passes DOCKER_HOST into job containers as an env var. It always
bind-mounts container.docker_host (read from ITS OWN filesystem) into
every job container as /var/run/docker.sock, and only recognizes
unix:// (or bare) paths -- a tcp:// value is silently treated as
unknown and falls back to a /var/run/docker.sock that doesn't exist in
the runner container, which is exactly the "no such file or directory"
error.

Expose dind's daemon over an additional unix socket on a volume shared
with the runner (dind-sock), and point docker_host at that shared path
so the bind-mount act_runner performs actually resolves to dind's real
socket. Verified by replicating act_runner's exact bind-mount pattern
against the running stack: `docker -H tcp://dind:2375 run -v
/dind-sock/docker.sock:/var/run/docker.sock ...` successfully ran
`docker info` and `docker build` inside a nested container.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XFsukF6FzwBxJtRGzbt28F

config.yaml

@@ -32,18 +32,21 @@ container:
   # Talk to the DinD daemon, not the host.
   network: ""
   privileged: false
-  # Job containers run *inside* the dind engine, on its own internal bridge network,
-  # so the "dind" hostname (only known on the outer compose network) doesn't resolve
-  # there. host-gateway maps it to dind's own bridge-gateway IP, where its dockerd
-  # listens (started with --host=tcp://0.0.0.0:2375), so job steps can reach it.
-  options: "--add-host=dind:host-gateway"
+  options: ""
   workdir_parent: ""
   # Allow workflows to mount caches from the DinD volume.
   valid_volumes:
     - "**"
-  # Pass DOCKER_HOST into job/service containers so steps that call `docker` directly
-  # (e.g. `docker build`) can reach the DinD daemon. Paired with the --add-host above.
-  docker_host: "tcp://dind:2375"
+  # act_runner bind-mounts this path (from its own container's filesystem) into
+  # every job/service container as /var/run/docker.sock -- it does not pass
+  # DOCKER_HOST through as an env var, and only unix:// (or bare) paths are
+  # recognized (see getDockerDaemonSocketMountPath in act_runner's source; a
+  # "tcp://" value is silently treated as unknown and falls back to the
+  # nonexistent default path). This is dind's docker.sock exposed over the
+  # dind-sock volume shared between the dind and runner services in
+  # docker-compose.yml, so job steps that call `docker` directly (e.g. `docker
+  # build`) reach the real DinD daemon.
+  docker_host: "unix:///dind-sock/docker.sock"
   force_pull: false
 
 host: