fix: matrix-job data races + outputs, leaner offline test suite (#994)

Running the full suite under `-race` (dropping `-short`) exposed pre-existing data races in parallel matrix-job execution, fixed by not sharing mutable state across combinations:

- `containerDaemonSocket()`/`validVolumes()` derive per-job values instead of mutating shared `Config`
- `getWorkflowSecrets` builds a fresh map, `rc.steps()` clones each step, and go-git workdir access is serialized
- every write to a shared `Job`'s result/outputs runs under a per-`Job` lock, each combo interpolating outputs from a pristine snapshot (last wins, as on GitHub)

### Test suite

- capability gates (docker / network / host-tools / Linux) replace the `-short` skips, and the suite runs offline via local fixtures (the artifact flow uses an in-process loopback server, only the docker-action force-pull needs the network)
- drops redundant tests, adds a regression test for https://gitea.com/gitea/runner/issues/981 and a docker-in-docker harness (`make test-dind`)

---
This PR was written with the help of Claude Opus 4.7

Reviewed-on: https://gitea.com/gitea/runner/pulls/994
Reviewed-by: Nicolas <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-committed-by: silverwind <me@silverwind.io>

act/runner/testdata/GITHUB_STATE/push.yml

@@ -1,48 +1,31 @@
 on: push
 jobs:
+  # State saved in main (via the $GITHUB_STATE file and the ::save-state command) must surface
+  # as $STATE_* in the action's post step.
   _:
     runs-on: ubuntu-latest
     steps:
-    - uses: nektos/act-test-actions/script@main
+    - uses: actions/checkout@v4
+    - uses: ./actions/script
       with:
-        pre: |
-          env
-          echo mystate0=mystateval > $GITHUB_STATE
-          echo "::save-state name=mystate1::mystateval"
         main: |
-          env
           echo mystate2=mystateval > $GITHUB_STATE
           echo "::save-state name=mystate3::mystateval"
         post: |
-          env
-          [ "$STATE_mystate0" = "mystateval" ]
-          [ "$STATE_mystate1" = "mystateval" ]
           [ "$STATE_mystate2" = "mystateval" ]
           [ "$STATE_mystate3" = "mystateval" ]
+  # State must be isolated per action instance even when two steps use the same action.
   test-id-collision-bug:
     runs-on: ubuntu-latest
     steps:
-    - uses: nektos/act-test-actions/script@main
+    - uses: actions/checkout@v4
+    - uses: ./actions/script
       id: script
       with:
-        pre: |
-          env
-          echo mystate0=mystateval > $GITHUB_STATE
-          echo "::save-state name=mystate1::mystateval"
-        main: |
-          env
-          echo mystate2=mystateval > $GITHUB_STATE
-          echo "::save-state name=mystate3::mystateval"
-        post: |
-          env
-          [ "$STATE_mystate0" = "mystateval" ]
-          [ "$STATE_mystate1" = "mystateval" ]
-          [ "$STATE_mystate2" = "mystateval" ]
-          [ "$STATE_mystate3" = "mystateval" ]
-    - uses: nektos/act-test-actions/script@main
+        main: echo mystate=val1 > $GITHUB_STATE
+        post: '[ "$STATE_mystate" = "val1" ]'
+    - uses: ./actions/script
       id: pre-script
       with:
-        main: |
-          env
-          echo mystate0=mystateerror > $GITHUB_STATE
-          echo "::save-state name=mystate1::mystateerror"
+        main: echo mystate=val2 > $GITHUB_STATE
+        post: '[ "$STATE_mystate" = "val2" ]'