dind: restore explicit DNS and a wider address pool

The 2026-09-05 rewrite dropped the dns: list, so dockerd inside dind
inherited the host's systemd-resolved (Tailscale DNS enabled) through
Docker's embedded resolver and got SERVFAIL for every public name -- every
job then died pulling the runner image, and Gitea left the jobs orphaned.

Restores three settings, each documented inline: dns: for dockerd's own
pulls, --dns for the job containers (tailnet resolver first, public second,
so MagicDNS names resolve inside a job), and --default-address-pool so a CI
run cannot exhaust the fifteen default /16s.

Committed this time. The same settings were applied on 2026-09-03 without a
commit and were lost to the next rewrite.

docker-compose.yml

@@ -14,9 +14,35 @@ services:
     # as an env var. A bare "tcp://..." isn't recognized and silently falls back
     # to /var/run/docker.sock, which doesn't exist in the runner container -- so
     # this shared socket is what makes `docker build` etc. work inside jobs.
-    command: ["dockerd", "--host=tcp://0.0.0.0:2375", "--host=unix:///var/run/docker.sock", "--host=unix:///dind-sock/docker.sock", "--tls=false"]
+    # Two DNS settings, for two different resolvers, and both are load-bearing.
+    #
+    #   dns: (below)   the dind CONTAINER's resolv.conf, which is what dockerd
+    #                  itself uses to pull images. Without an explicit list it
+    #                  inherits Docker's embedded resolver, which forwards to
+    #                  the host's systemd-resolved; with Tailscale DNS enabled
+    #                  there, public names come back SERVFAIL and every job
+    #                  dies at "docker pull" of the runner image itself. This
+    #                  is what took the runner down on 2026-09-05.
+    #
+    #   --dns (here)   what dockerd hands to the JOB containers it creates.
+    #                  The tailnet resolver first, so NOMAD_ADDR and the
+    #                  staging Postgres resolve inside a job (they are
+    #                  MagicDNS names); a public resolver second, because
+    #                  100.100.100.100 answers only for the tailnet and
+    #                  SERVFAILs everything else -- getaddrinfo falls through.
+    #
+    # --default-address-pool replaces the daemon default of fifteen /16s in
+    # 172.17-172.31, which a CI run exhausts ("all predefined address pools
+    # have been fully subnetted"): the host holds three, each lane creates its
+    # own network, and a killed job leaves one behind. 10.210/16 in /24s is 256
+    # networks and collides with nothing here (no 10.x route on the host; the
+    # tailnet is 100.64/10).
+    command: ["dockerd", "--host=tcp://0.0.0.0:2375", "--host=unix:///var/run/docker.sock", "--host=unix:///dind-sock/docker.sock", "--tls=false", "--dns=100.100.100.100", "--dns=1.1.1.1", "--default-address-pool", "base=10.210.0.0/16,size=24"]
     environment:
       DOCKER_TLS_CERTDIR: ""
+    dns:
+      - 1.1.1.1
+      - 1.0.0.1
     networks:
       - runner
     volumes: